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1.0  INTRODUCTION  AND  SUMMARY 


This  report  presents  the  results  of  a Definition  Study  for  an  Advanced 
Fighter  Digital  Flight  Control  System.  A synergistic  combination  of  flight  control 
capabilities  and  extensive  crew  system  integration  was  defined  through  a series 
of  studies  and  simulations  and  evaluated  by  service  pilots  in  a comprehensive 
simulation  program.  Significant  improvements  in  tactical  effectiveness  with  reduced 
pilot  workload  were  found. 

Customized  flight  control  modes  were  designed  for  specific  mission  segments  to 
provide  enhanced  tactical  effectiveness.  The  capabilities  for  relaxed  static  sta- 
bility and  both  direct  lift  and  direct  side  force  control  were  incorporated  into 
these  customized  control  modes.  In  addition,  provisions  were  included  which  enable 
flight  at  high  angles-of-attack  without  the  danger  of  aircraft  departure  or  over- 
stressing. 

Crew  system  integration  was  accomplished  to  give  capabilities  never  before 
present  in  a fighter  aircraft  while  at  the  same  time  reducing  pilot  workload  and 
required  instrument  panel  area.  Head-up  and  multi-function  displays  were  provided 
for  presentation  of  data  keyed  to  the  flight  control  mode  selected  and  needed  by 
the  pilot  to  accomplish  his  immediate  objective.  Hands-on-stick-and-throttle  weapon 
and  mode  control  were  provided  for  all  tasks  requiring  rapid  access.  A flight 
management  capability  was  implemented  to  provide  for  position  fixing,  flight  plan 
management,  airport  approach  and  departure  procedures,  and  electronic  warfare  data 
required  to  support  tactical  fighter  operations.  The  flight  management  implementa- 
tion also  provides  a fully  automatic  three  dimensional  area  navigation  system 
capable  of  navigating  directly  between  any  two  points  as  well  as  on  airways,  SIDs, 
STARs,  and  RNAV  routes.  A computer  and  display  controller  was  included  which 
demonstrated  a simple  and  effective  means  of  communication  between  the  pilot 
and  computers.  The  flight  management  computer,  rather  than  the  pilot,  performs 
navigation  sensor  management,  such  as  frequency  selection  and  initialization. 

These  flight  management  characteristics  have  provided  a significant  step  toward 
enabling  the  pilot  to  become  a mission-oriented  manager  rather  than  a subsystem 
operator. 

Fly-by-wire  (FBW)  controls  have  been  the  catalyst  that  make  the  above  advance- 
ments possible,  and  digital  technology  provides  the  flexibility  and  computational 
capacity  to  implement  these  capabilities  in  a cost-effective  manner. 

The  Definition  Study  for  an  Advanced  Fighter  Digital  Flight  Control  System  is 
a joint  Air  Force  and  Navy  exploratory  definition  study  performed  by  McDonnell 
Aircraft  Company  (MCAIR)  as  prime  contractor  to  the  Air  Force  Flight  Dynamics 
Laboratory  (AFFDL)  to  consolidate  the  large  amount  of  general  foreground  research 
in  digital  flight-control  and  display  technology.  General  Electric,  Honeywell, 

Lear  Siegler  and  Collins  supported  MCAIR  in  the  analyses  and  simulations  associated 
with  this  program.  This  study  is  a precursor  to  an  Advanced  Development  Program 
(ADP)  to  accomplish  flight  validation  of  the  design  criteria  and  the  performance 
and  cost  advantages  promised  by  these  technologies  when  applied  to  advanced  tactical 
fighter  aircraft. 
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The  objectives  of  the  Digital  Flight  Control  System  (DFCS)  Definition  Study 


o Derive  and  Evaluate  for  Advanced  Air  Force  and  Navy  Tactical  Fighters: 

o Custom  Multimode  Control  Laws  (matched  to  segments  of  a tactical  mission) 
o Displays  Pertinent  to  Each  of  the  Multimodes 
o Multi-Channel  Digital  FBW  Configurations 
o Develop  New  Performance  - Cost  - Time  Options 
o Define  Candidate  Flight  Control  and  Display  Schemes 
o Define  a Recommended  ADP  Configuration 

The  Precision  Aircraft  Control  Technology  (PACT)  configuration  of  F-4  S/N  62-12200, 
modified  to  include  differentially  controllable  canards,  was  used  as  the  test 
case"  aircraft,  Figure  1,  for  analytical  and  simulation  efforts  during  this  stu  y. 
The  conceptual  design  of  the  Digital  FCS  is  for  a single-place  fighter  having  the 
capability  of  performing  Air  Force  and  Navy  mission  tasks  defined  by  a 14-segment 
Mission  Scenario,  Figure  2.  The  scope  of  the  cockpit  controller  and  display  study 
and  other  integration  effort  was  limited  to  include  only  those  functions  which  are 
flight  control  related.  Other  controllers  and  display  functions  such  as  those  rela 
ing  to  Communications,  Armament,  and  Engine  Instruments  were  excluded.  The  overall 
approach  utilized  by  MCAIR  in  performing  this  study  is  depicted  by  Figure  3. 
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A summary  of  the  analytical  studies  performed  and  the  results  of  analyses  and 
simulations  are  presented  in  Section  2.0.  A description  of  the  testing  and  evalua- 
tions performed  on  the  design  aid,  advanced  fighter  mockup  and  man-in— loop  simula- 
tions is  contained  in  Section  3.0.  A recommended  configuration  for  an  Advanced 
Development  Program  is  presented  in  Section  4.0.  Support  provided  by  four  companies 
under  subcontract  to  MCAIR  is  described  in  Section  5.0. 

Manual  and  automatic  flight  control  modes  developed,  evaluated  in  simulation, 
and  recommended  for  ADP  are  presented  in  Figures  4 and  5. 


Evaluated  During 
Man  in-the- Loop  Simulations 


Recommended  for 
I ncorporation  Into  ADP 


• Normal 

• Gear  Up:  Cruise 

• Gear  Down:  Airfield  Takeoff 
and  Landing 

• Carrier  Takeoff  and  Landing 

• Air-to-Air  Combat 

• With  Planar  Turn 

• Without  Planar  Turn 

• Air-to-Ground  Bombing 

• Air-to-Ground  Gunnery 


• Normal^) 

• Gear  Up:  Cruise 

• Gear  Down:  Airfield  and  Carrier 
Takeoff  and  Landing 


• Air-to-Air  Combat 

• Without  Planar  Turn 

• Air-to-Ground  Bombing 

• Air-to-Ground  Gunnery 


• Fixed  Canards 

• DigiPACT<2>  * DigiPACT<2> 

(^Includes  Operable  and  Fixed  Canards 

(^DigiPACT  - Digital  Implementation  of  SFCS-PACT  Control  Laws 
(Provided  for  Purposes  of  Comparison) 


Figure  4 

Manual  Modes  for  the  ADP 


Evaluated  During 
Man-1  n-The-Loop  Simulations 

• Pitch  Attitude  Hold 

• Roll  Attitude  or  Heading  Hold 

• Altitude  Hold 

• Preselect  Heading 

• Automatic  Throttle 

• Automatic  Vertical  Navigation 

• Automatic  Lateral  Navigation 

• Automatic  Carrier  Landing 

Not  Evaluated  During 
Man-1  n-The-Loop  Simulations 

• Automatic  I LS 

• Automatic  Energy  Management 


Recommend  For 
Incorporation  Into  ADP 

• Pitch  Attitude  Hold 

• Roll  Attitude  or  Heading  Hold 

• Altitude  Hold 

• Preselect  Heading 

• Automatic  Vertical  Navigation 

• Automatic  Lateral  Navigation 


Available  Options  For  ADP 

• Automatic  I LS 

• Automatic  Energy  Management 

• Automatic  Throttle 

• Automatic  Carrier  Landing 


Figure  5 

Automatic  Modes  for  the  ADP 


A DFCS  cockpit  arrangement.  Figure  6,  evolved  from  an  iterative  process  of 
evaluations  and  refinements  of  design  layouts,  mockups,  and  a full  scale  design 
aid.  Features  of  this  arrangement  include: 

o Principal  mission  and  flight  information  presented  on  a Head-Up  Display 
(HUD)  and  two  CRT  Multi-Function  Displays  (MFD  I and  II), 

o Primary  flight  controllers  mounted  on  the  armrests  of  the  seat, 

o Redundant  Computer  and  Display  Controllers  (CDC)  for  pilot-computer 
communications  and  central  control  of  flight  control  modes  and  related 
displays,  and 

o Compatibility  with  high-acceleration  cockpit  concept. 


and  Controllers 

Display  information  requirements  and  task  identifications  were  determined  from 
an  analysis  of  the  functions  required  to  perform  each  of  the  segments  of  the  mission 
scenario.  Pilot  workload  was  a factor  of  major  consideration  in  the  partitioning 
of  display  information  and  assignment  of  tasks  for  flight  management.  A comparison 
was  made  of  pilot  workloads  calculated  from  data  obtained  during  static  and  dynamic 
evaluations,  for  the  DFCS  and  an  Advanced  Fighter  currently  in  Air  Force  inventory. 
Figure  7,  shows  that  the  DFCS  configuration  resulted  in  a reduced  workload  for 
each  of  the  seven  segments  simulated. 
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Figure  7 

Workload  Results 

DFCS  vs  Advanced  Fighter 

A general-purpose  fighter  control  law  (DigiPACT)  was  used  for  purposes  of 
comparison  during  man-in-loop  simulations  to  determine  the  relative  effectiveness 
of  the  customized  DFCS  control  laws.  Results  obtained  show  that  the  pilots 
ability  to  perform  specified  mission  tasks  was  enhanced  when  using  the  customized 
DFCS  control  laws.  A sample  of  these  tracking  results  is  illustrated  in  Figure  8 
for  the  customized  air  combat  mode  (ACM)  and  the  general  purpose  DigiPACT  mode. 


Tracking  Figure  of  Merit 
(FOM)  Results 
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Figure  8 

Integrated  Control  Law  and  Display  Simulation 

Representative  Air-to-Air  Combat  Effectiveness  Data 


A triplex  flight  control  system  is  recommended  for  evaluation  in  an  ADP  on  the 
basis  of  studies  conducted  on  six  initial  configuration  candidates,  Figure  9.  A 
more  detailed  description  of  each  configuration  candidate  is  contained  in  Section 
2.12.  Comparative  results  of  studies  for  the  three  "sound  candidates"  are  shown  in 
Table  1.  These  comparisons  show  that  the  triplex  configuration  features: 


o Lowest  weight 
o Best  maintainability 


o Good  reliability 
o Lowest  cost 


Initial  Candidates 


I 


1 

2 

3 

4 

5 
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Quadruplex  DFCS 
• Comparison  Monitored 


Quadruplex  DFCS 

• Comparison  Monitoied 

• Area  Multiplex 


Simplex  DFCS  with 
Analog  Backup 


Triplex-Quadruplex  DFCS 


Triplex  DFCS 
• In-Line  Monitored 


Triplex  DFCS 

• In-Line  Monitored 

• Area  Multiplex 


Figure  9 

Configuration  Development 


I 


Table  1 

Three  Sound  Candidates 

Summary  of  Analyses 


A redundancy  management  scheme  was  defined  to  provide  protection  from  loss  of 
control  through  use  of  comparison  monitoring  to  detect  first  failures  and  in-line 
monitoring  to  detect  subsequent  failures.  Necessary  computer  capacity  and  capa- 
bilities to  accomplish  both  the  flight  control  mode  and  redundancy  management 
implementation  were  assessed. 

Studies  and  simulations  indicate  that  mission-oriented  flight  control  laws 
integrated  with  head-up  and  multi-function  displays,  hands-on-stick-and-throttle 
weapon  and  mode  control,  and  computer  and  display  controller  for  pilot-to-computer 
communications  can  provide: 

o Enhanced  mission  effectiveness,  with 

o Reduced  pilot  workload. 

The  demonstrated  capabilities  of  the  computer  and  display  controller  to  provide  a 
simple  and  effective  means  of  communication  between  the  pilot  and  computers  suggests 
the  feasibility  for  integrating  and  time-sharing  other  pilot  control  functions. 
Potential  benefits  include:  more  efficient  use  of  panel  space,  increased  pile': 

efficiency,  further  reduction  in  pilot  workload,  and  reduced  cost  of  ownership. 

It  is  recommended  that  the  concepts  analyzed  and  simulated  during  the  defini- 
tion study  be  implemented  and  evaluated  by  flight  testing. 
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2.0  ANALYSES 


2.1  GENERAL 

This  section  presents  a summary  of  the  results  of  analyses  conducted  curing 
the  Digital  FCS  Study  program  by  engineers  with  expertise  in  many  technical  disci- 
plines. All  analyses  were  designed  to  produce  conclusions  generally  applicable  to 
any  advanced  fighter  aircraft.  The  fly-by-wire  aircraft  described  in  Section  1.0 
was  utilized  as  a "test  case"  for  application  of  the  results  of  these  analyses. 

This  section  discusses  analyses  in  the  following  subsections: 

o Mission-Scenario  Analysis  ° Analysis  of  Industry  Expertise 

o Evaluation  Criteria  0 Software  Analysis 

o Control  I.aw  Development  ° Single-Point-Failure  Analysis 

o Electrical  Backup  (EBU)  0 Safety  Analysis 

o Pilot  Interface  0 Reliability  Analysis 

o Displays  and  Controllers  Development  o Maintainability  Analysis 

o Multiplex  Analysis  0 Effectiveness  Analysis 

o Lightning  Protection  ° Workload  Analysis 

o Electromagnetic  Compatibility  (EMC)  o Survivability  Analysis 

o Built-In  Test  and  Inflight  Integrity  o Cost-of-Ownership  Analysis 

Management  (BIT  and  IFIM) 

o Redundancy  Management  and/or  IFIM 
Ana lysis 


2.3  EVALUATION  CRITERIA 


2.3.1  GENERAL  - A set  of  properly  structured  criteria  was  necessary  for  evaluating 
the  change  in  effectiveness  and  pilot  workload  resulting  from  the  incorporation  of 
multimode  control  laws  and  advanced  displays.  It  was  desirable  that  the  criteria 
selected  for  there  evaluations  be  applicable  both  for  use  in  the  analysis,  mockup 
and  simulations  performed  during  the  Digital  FCS  Definition  Study  and  for  subse- 
quent flight  testing  to  be  performed  under  the  ADP.  The  criteria  selected  during 
this  DFCS  Definition  Study  for  effectiveness  evaluations  are  expressed  in  terms 

of  tracking  errors.  The  criterion  for  pilot  workload  evaluations  is  expressed  in 
terms  of  the  ratio  of  time  required  to  perform  a task  sequence  to  the  time  avail- 
able for  its  performance.  A discussion  of  these  criteria  is  presented  below. 

2.3.2  EFFECTIVENESS  CRITERIA  - The  effectiveness  evaluation  criteria  used  throughout 
the  analysis  and  simulation  phases  of  the  DFCS  Definition  Study  were  based  on  track- 
ing error  and  tracking  error  statistics  obtained  during  gun-cross  ("iron  sight") 
tracking.  The  tracking  error  statistics  consisted  of  the  means  and  variances  of 

the  tracking  error  elevation  and  traverse  components.  These  criteria  enable  an 
evaluation  of  the  capability  of  the  Digital  FCS  configured  fighter  aircraft  to 
deliver  its  ordnance  accurately. 

The  above  effectiveness  criteria  were  chosen  in  order  to  maintain  consistency 
in  evaluating  the  Digital  FCS  during  the  analysis  and  simulation  phases  of  this 
study  and  for  their  applicability  to  future  flight  test  data  reduction.  Although 
the  fire-control  system  to  be  used  during  flight  testing  under  the  ADP  may  not  con- 
sist of  a simple  gun-cross  mechanization,  the  use  of  tracking  error  statistics  with 
a simple  "iron  sight"  can  always  be  used  as  a basic  measure  of  effectiveness 
regardless  of  the  type  of  fire-control  system  or  weapons  that  are  being  considered 
for  the  weapon  system.  Tracking  errors  will  reflect  differences  in  flight  control 
system  characteristics  regardless  of  fire-control  and  weapon  characteristics. 

Examples  of  the  application  of  these  effectiveness  criteria  to  analytical  and 
man-in- the-loop  simulation  data  for  the  multimode  control  laws  are  presented  in 
Section  2.19  of  this  report. 

2.3.3  PILOT  WORKLOAD  CRITERIA  - The  pilot  workload  evaluation  criterion  used  during 
analysis,  mockup,  and  simulation  phases  of  the  Digital  FCS  Definition  Study  was 
expressed  in  terms  of  the  ratio  of  time  required  to  perform  the  tasks  required  during 
each  segment  to  the  time  available  for  their  performance.  Workload  was  calculated 
separately  for  visual,  right  hand,  left  hand,  and  information  processing.  Figure  11 
summarizes  the  pilot  workload  criteria.  This  type  of  workload  criteria  was  used 

in  conducting  the  workload  analyses  in  the  High  Acceleration  Cockpit  (HAC)  contracts 
cited  in  References  (1)  and  (2). 


References:  1.  High  Acceleration  Cockpits  for  Advanced  Fighter  Aircraft.  Contract 

No.  F33615-73-C-3067.  AFFDL,  Wright-Patterson  AFB , Ohio. 

2.  High  Acceleration  Cockpit  Variable  Seat/Control  Assembly.  Contract 
No.  FSSblS-Vl-C-OSSS.  AeroMed  Research  Laboratory. 
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• Workload  is  Expressed  as  a Percentage: 

— Time  Required  to  Perform  Tasks  x 100 

W - — — — 

Time  Available 


• Worxload  is  Calculated  Separately  for  Visual  (V),  Right 
Hand  (R),  Left  Hand  (L)  and  Information  Processing  (IP), 
For  Example: 

- Time  Required  to  Perform  Right  Hand  Tasks  x 100 

R — " — ■ — — - — - - — — — • 

Total  Mission  Segment  Time 

• Total  Pilot  Workload: 

wt  = v + r + l+ip 


Figure  11 

Pilot  Workload  Criteria 


To  achieve  the  effective  integration  of  man  into  the  developed  configuration, 
the  principles  and  criteria  of  human  engineering  contained  in  MIL-STD-1472A,  AFSC* 
DH1-3 , MIL-C-81774,  MIL-H-46855,  and  other  applicable  design  criteria,  standards, 
and  specifications  were  applied  throughout  the  Digital  FCS  study.  The  introduction 
of  a flight  management  system  achieved  significant  improvements  in  workload  by 
establishing  a simple  and  effective  means  of  communication  between  the  flight 
management  computer  and  the  pilot,  by  eliminating  routine  tasks  traditionally  per- 
formed by  pilots,  and  by  restructuring  the  information  available  for  the  decision 
process.  Automation  of  the  flight  activities  and  integration  of  the  flight  control 
modes  with  relevant  display  formats  also  reduced  task  complexity  and  pilot  workload. 
These  flight  management  system  characteristics  have  provided  a significant  step 
toward  enabling  the  pilot  to  become  a mission  oriented  manager  rather  than  a subsystem 
operator. 

The  results  of  the  application  of  this  pilot  workload  evaluation  criteria  to 
the  Digital  FCS  are  presented  in  Section  2.20. 


2.4  CONTROL  LAW  DEVELOPMENT 


2.4.1  INTRODUCTION  - A set  of  control  laws  was  developed  for  the  "test  case" 
aircraft  employing  the  use  of  ailerons,  spoilers,  stabilator,  rudder,  split  hori- 
zontal canards,  cockpit  control  devices,  and  engine  thrust.  The  canards  were 
collectively  operable  for  pitch  and  Direct  Lift  Control  (DLC) , and  dif f °rentially 
operable  for  Direct  Side  Force  (DSF)  control. 

The  control  laws  utilized  the  advantages  of  both  full-authority  digital  fly-by- 
wire  techniques  and  pilot-essential  displays  to  enhance  flight  safety,  combat 
survivability,  and  mission  accomplishment.  In  its  modified  configuration,  the  "test 
case"  aircraft  represents  an  advanced  fighter  with  a mission  profile  suitable  for  both 
the  Navy  and  Air  Force  roles.  Therefore,  the  control  law  design  emphasized  air 
superiority,  interdiction,  close-air-support,  and  fleet-air -defense.  The  control 
laws  were  divided  into  two  major  groups;  namely,  manual  (pilot-assist)  modes  and 
automatic  (pilot-relief)  modes.  Those  pilot-assist  modes  developed  for  weapon 
delivery  were  designed  for  increased  effectiveness;  the  other  inodes  were  designed 
for  improved  handling  qualities. 

The  design  approach  to  developing  the  control  laws  was  first  to  establish  good 
continuous  control  systems  based  on  classical  continuous  synthesis  and  analysis 
techniques  and  subsequently  to  consider  the  digitization  of  the  control  laws. 

The  design  task  was  accomplished  using  small  perturbation  airframe  models  in  con- 
junction with  root  locus,  frequency  response,  and  time  history  computer  programs 
which  were  adapted  for  this  purpose.  Section  2.4.2  presents  the  handling  qualities 
criteria  used  in  the  development  of  the  control  laws.  Sections  2.4.3  through  2.4.7. 
then  describe  the  initial  control  law  design  in  the  continuous  form.  Following 
this  initial  design,  the  control  laws  were  evaluated  and  refined  during  man-in- the- 
loop  simulations  as  discussed  in  Sections  3.3.1  and  3.3.3. 

2.4.2  HANDLING  QUALITIES  CRITERIA 

o MIL-F-8785B  o Time  Response  Criteria 

o C*  Criterion 

o Specialized  Mode  Criteria  o D*  Criterion 

o Roll  Axis  Response  Criterion 
o Time  Response  Parameter  (TRP) 

As  a guide  in  the  development  of  the  DFCS  Control  Laws,  a number  of  handling 
qualities  criteria  were  identified  in  a literature  search  and  reviewed  for  appli- 
cability to  the  control  modes.  These  criteria  fall  into  three  basic 
categories : 

o Handling  qualities  criteria  typified  by  the  MIL-F-8785B  Reference  (3) 
handling  qualities  specification  and  Reference  (4), 

References:  3.  "Flying  Qualities  of  Piloted  Airplanes,"  MIL-F-8785B  (ASG) , 

7 August  1969.  i 

4.  Abrams,  C.  R. ; "The  Effects  of  Rudder  Feedback  on  the  Carrier 
Approach  Configuration  of  the  F-111B",  Report  No.  NADC-AM-6816 , 
Naval  Air  Development  Center,  Warminster,  Pa.,  1968. 
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o Time  response  criteria  including  response  envelopes  as  in. Ref erences  (5) 

and  (6),  and  the  Time  Response  Parameter  (TRP ) Index  from  Reference  (7),  and 


o System  requirements  for  specialized  modes  such  as  the  Automatic  Carrier 
Landing  criteria  in  Reference  (8),  and  the  ILS  criteria  as  defined  in 
Reference  (9) . 


Figures  12  through  14  present  the  time  response  criteria  envelopes  from  References 
(5),  (6)  and  (7). 


C*  Normalized 
Response 


Category 


Applicable 

Tasks 

Ground  Attack 
Penetration  and 
Aerial  Combat 


Refueling  and 
Cruise 


Time  sec 


Figure  12 

C*  Response  Criterion 


References: 


5.  Tobie,  H.  N.,  Elliott,  E.  M.,  "New  Short  Period  Handling  Quality 
Criterion  for  Fighter  Aircraft",  Boeing  Document  No.  D6-17841  T/N 
September  1965. 


Kisslinger,  R.  L.  and  Wendl,  M.  J.;  "Survivable  Flight  Control 
System  Interim  Report  No.  1 Studies,  Analysis  and  Approach", 
Supplement  for  Control  Criteria  Studies,  AFFDL-TR-71-20  Supple- 
ment 1,  May  1961. 


Abrams,  C.  R.;  "A  Performance  Index  for  Response  Evaluation  of 
Highly  Augmented  Military  Aircraft",  Report  No.  NADC-AM-7103, 
Naval  Air  Development  Center,  Warminster,  Pa.,  12  October  1971, 


®*  All-Weather  Carrier  Landing  System  Airborne  Subsystem,  General 
Requirements  for", ,Report  No.  AR-40,  Naval  Air  Systems  Command, 
1 May  1969. 


FAA  Advisory  Circular  AC  120-29,  "Criteria  for  Approving  Cate- 
gory I and  Category  II  Landing  Minima  for  FAR  121  Operators", 
25  September  1970. 
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Roll  Axis  Response  Criteria 


D*  Response  Criteria 


Upper  Boundary 


Lower  Boundary 


Upper  Boundary 


Lower  Boundary 


Upper  Boundary 
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Figure  13 

Roll  Axis  and  D*  Response  Criteria 
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Figure  14 

Time  Response  Parameter  (TRP) 

TRP  = TRP#  + TRPn 

2.4.3  MANUAL  (PILOT-ASSIST)  MODES 


o Normal 

o Air-to-Air  Combat 
o Air-to-Ground  Bombing 
o Air-to-Ground  Gunnery 


o Manual  Carrier  Landing 
o Fixed  Canards 
o DigiPACT 


Pilot-assist  modes  were  developed  to  assess  the  feasibility  and  desirability 
of  incorporating  into  the  Digital  PCS  certain  customized  multimodes  which  integrate 
vehicle  control  with  mission  demands  to  improve  weapon-system  effectiveness  as 
defined  in  Section  2.3.2.  The  multimodes  provide  for  enhanced  mission  effective- 
ness in  tactical  missions  such  as  strafing,  bombing,  missile  launch,  target  tracking, 
aerial  refueling,  and  landing.  The  modes  developed  for  these  missions  are  the 
Normal  Mode,  Air-to-Air  Combat  Mode,  Air-to-Ground  Bombing  Mode,  Air-to-Ground 
Gunnery  Mode  and  Manual  Carrier  Landing  Mode.  The  TWeaD  control  laws  reported  in 
Reference  (10)  were  used  as  a source  of  control  law  methodology  for  these  modes. 

The  results  of  the  multimode  studies  reported  in  Reference  (11)  were  also  utili^ud. 

Two  additional  pilot-assist  modes,  the  DigiPACT  Mode  and  Fixed  Canards  Mode, 
were  included  in  the  study.  The  DigiPACT  Mode  is  a general-purpose  mode  (in  con- 
trast to  the  previously  mentioned  customized  multimodes)  and  was  employed  as  a 
comparison  mode;  the  Fixed  Canards  Mode  was  developed  to  provide  adequate  handling 
qualities  (Category  2 of  Reference  (6))  in  the  pitch  axis  in  the  event  of  a failure 
in  the  canard  control  path. 

Control  laws  incorporating  active  feedback  elements  which  enable  direct  pilot 
control  of  aircraft  motion  were  developed  for  all  pilot-assist  modes.  Pitch  rate, 
roll  rate,  yaw  rate,  normal  acceleration  and  lateral  acceleration  feedbacks  were 
utilized  to  provide  control  of  aircraft  rates  and  accelerations  as  well  as  to 
damp  aircraft  response  to  external  environmental  disturbances.  Sideslip  and  angle- 
of-attack  (AOA)  signals  were  also  included  in  the  design  of  some  of  the  modes. 

2. 4. 3.1  Normal  Mode 


Features 

o Uniform  transient  response 
o Neutral  Speed  Stability  - Gear  Up 
o Improved  turn  coordination 
o Direct  Lift  capability 
o Lateral  Translation  capability 

References:  10.  Carleton,  D.  L. , et  al,  "Development  and  Evaluation  of  the 

TWeaD  II  Flight  Control  Augmentation  System",  Technical  Document 
FTC-TD-72-1,  Edwards  AFB,  California,  August  1971. 

11.  Quinlivan,  R.  P.,  "Multimode  Flight  Control  Definition  Study 

for  Precision  Weapon  Delivery",  Technical  Report  AFFDL-TR-7 1-39 , 
Wright  Patterson  AFB,  Ohio,  June  1971. 
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o Reduced  accelerations  due  to  gusts 
o Departure  prevention 

The  Normal  Mode  was  designed  for  use  throughout  the  appilcable  flight  envelope 
for  takeoff  cruise,  and  landing,  either  clean  or  with  stores.  In  addition,  it 
was  used  for  all  mission  segments  including  weapon  delivery  in  the  absence  °* 
specialized  modes.  The  design  of  the  Normal  Mode  included  selection  of  them o^ 
effective  feedback  variables  and  use  of  handling  qualities  criteria 
Section  2.4.2  to  achieve  reduced  control  system  and  airframe  C° 

variations  in  flight  conditions.  The  primary  purposes  of  the  Normal  Mode  were 


to : 


o Function  as  the  principal  control  law  used  in  up-and-away  flight, 

o To  provide  a good  starting  point  for  the  development  of  the  other  pilot- 
assist  modes,  and 

„ To  provide  the  basic  inner  loop  stabilization  for  the  specialized  pilot- 
relief  modes. 

(a ^ T rmo-itudinal  Axis  - A block  diagram  of  the  Normal  Mode  longitudinal  axis 
( coiitrol  law  Is' presented  in  Figure  15.  The  longitudinal  control  surfaces 
are  the  stabilator  and  close-coupled  horizontal  canards  geared  together 
through  a canard  schedule  to  provide  minimum  maneuvering  drag.  A fj*®® 
up"  control  signal  was  provided  through  a washout  networ  o „ 

in  addition  to  the  canard  schedule  signal.  The  purpose  P P 

signal  was  to  provide  anticipation  to  achieve  quicker  responses  to 
longitudinal  input  commands.  Feedback  signals  consisted  ^ 

pitch  rate  and  normal  acceleration.  Neutral  Speed  Stabiiity  (NSS) 
provided  through  the  use  of  integral- plus -proportional  control  in  the 
forward  path  to  compensate  for  the  charge  in  trim  requirements  due  to 
changes  in  aircraft  speed  and  altitude.  In  order  to  achieve  a satisfac- 
tory balance  of  stability  margins  and  transient  response  performance  ove 
the  flight  envelope,  the  forward  loop  gain  was  scheduled  with  dynam 
pressire  as  discussed  in  Section  2.4.5.  A Departure  Preventer  was 
incorporated  in  the  design  as  discussed  in  Paragraph  (c) . 

A Direct  Lift  capability  which  permits  small  changes  in  altitude  without 
c^fln  ^ttltuL  was  provided 

deflected  canards,  and  a^ettically 

deflected  ailerons  and  spoilers.  Networks  required  to  decouple  the  pitch 
and  altitude  responses  were  designed  in  an  open  loop  fashion.  Thi 
approach  to  implementing  DLC  required  control  network  parameter  schedu  g 
since  the  decoupling  networks  varied  with  flight  condition  and  contro 
surface  deflection.  Scheduling  could  be  minimized  if  tasks  requiring 
DLC  were  performed  at  a limited  number  of  flight  conditions.  The  Normal 
Mode  control  laws  had  the  DLC  optimized  for  refueling  (approximately  0.7 
Mach  at  20,000  ft)  and  landing. 
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Figure  15 
Normal  Mode 

Longitudinal  Axis  Block  Diagram 


The  two-slope  nonlinear  gradient  used  to  transform  longitudinal  pilot 
force  inputs  into  an  electronic  signal  is  presented  in  Figure  16.  Two 
different  sidestick  controllers  were  used  in  the  manned  simulation 
evaluations  and  each  controller  produced  the  same  nonlinear  output  char- 
acteristics as  illustrated  in  Figure  16.  Breakout  forces  were  approxi- 
mately 1.6  lb.  and  the  small  slope  near  the  null  force  reduced  stick 
sensitivity  for  small  inputs. 
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Figure  16 

Longitudinal  Stick  Shaping 


Figure  17  presents  normalized  C*  responses  for  the  Normal  Mode  clean 
configuration  at  three  well  separated  flight  conditions.  Design  goals 
were  to  meet  the  Category  II  C*  boundaries  presented  in  Figure  12.  The 
TRP  index,  presented  with  each  flight  condition  in  Figure  17,  was  com- 
puted per  Reference  (7) . 


Normalized 
C*  Response 


Figure  17 

Normalized  C*  Responses  with  TRP  Index 
DFCS  Normal  Mode 


Lateral-Directional  Axes  - Figure  18  is  a block  diagram  of  the  Normal  Mode 
lateral-directional  control  laws.  Lateral-directional  control  surfaces 
are  the  ailerons  and  spoilers  in  the  lateral  axis  and  the  rudder  and 
differential  horizontal  canards  in  the  directional  axis.  Differential 
canards  were  reserved  for  Lateral  Translation  capabilities  only.  The 
lateral  axis  utilized  proportional  roll  rate  feedback.  The  directional 
axis  employed  washed  out  proportional  yaw  rate  feedback  for  yaw  damping 
and  proportional-plus -integral  feedback  of  blended  sideslip  angle  and 
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lateral  acceleration.  This  arrangement  provided  good  dutch-roll  damping 
^°°rdinatlon  during  roll  maneuvers.  Crossfeeds  of  roll  rate 
mu  tiplied  by  AOA  (P*a),  and  of  scheduled  roll  rate  error  signals  as  a 
unction  of  AOA  were  provided  to  further  improve  turn  coordination, 
r ncxpal  design  criteria  for  these  axes  were  the  roll  rate  and  D* 
handling  qualities  criteria  (Figure  13)  developed  in  the  SFCS  program. 
Representative  Normal  Mode  lateral-directional  roll  rate  and  D*  time 
responses  are  presented  in  Figures  19  and  20. 


A Lateral  Translation  capability  was  available  in  the  Normal  Mode 
through  a thumb  operated  controller  on  the  SSC.  Lateral  Translation 

r!nUSi!°/0minTl!d  Sma11  sidesllP  angles  without  changing  heading  or 
roll  attitude.  The  networks  for  Lateral  Translation  were  defined  in  the 

same  open  loop  manner  as  the  DLC  networks  in  the  longitudinal  axis,  thus 
the  lateral-translation-network  parameters  were  also  scheduled  with 
flight  condition. 
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Figure  19 

Normalized  Roll  Axis  Response 
DFCS  Normal  Mode 
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Figure  20 

Normalized  D*  Response 
DFCS  Normal  Mode 


The  parabolic  shaping  network  used  to  convert  lateral  pilot  force  inputs 
into  electronic  command  signals  is  presented  in  Figure  21.  Included  in 
Figure  21  is  the  three-slope  gradient  used  for  shaping  in  the  SFCS  and 
Precision  Aircraft  Control  Technology  (PACT)  flight  test  programs,  and 
retained  for  the  DigiPACT  mode. 
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Roll  Rate  Command  Shaping 
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(c)  Departure  Preventer  - One  of  the  primary  features  of  all  of  the  multi- 

mode  control  laws  is  that  aircraft  motion  is  the  controlled  variable  rather 
than  control  surface  position.  A Departure  Preventer  was  included  to 
prevent  the  pilot  from  inadvertently  commanding  excessive  g loads  beyond 
the  aircraft  structural  limits  or  from  driving  the  aircraft  into  uncon- 
trollable angles-of-attack . The  Departure  Preventer  modified  the 
longitudinal  and  lateral  axes  control  laws  as  the  aircraft  load  factor, 

AOA  and  sideslip  angle  approach  control  limits  so  that  the  limits  were 
not  exceeded  and  adequate  control  was  maintained.  In  the  longitudinal 
axis,  the  Departure  Preventer  functioned  by  controlling  the  rate  limit  of 
the  pre filter.  Measured  values  of  AOA,  sideslip  angle  and  load  factor 
were  compared  to  schedules  in  the  Departure  Preventer,  and  the  prefilter 
rate  limits  adjusted  so  that  the  most  adverse  pilot  inputs  would  not 
cause  the  aircraft  response  to  exceed  the  safe  limits  of  the  measured 
variables.  Sufficient  authority  was  given  to  the  Departure  Preventer 
to  permit  a change  in  sign  of  the  pilot  input,  if  necessary,  to  prevent 
exceeding  those  safe  limits. 

Statically  unstable  aircraft  such  as  the  "test  case"  aircraft  place 
stringent  requirements  on  longitudinal  control  surface  rates.  If  rates 
are  not  high  enough  to  permit  rapid  pilot  inputs  to  be  followed,  the 
effective  gain  in  the  longitudinal  control  loop  can  be  driven  to  a 
reduced  value  to  the  point  that  limit  cycle  oscillations  will  occur.  For 
this  reason,  the  maximum  values  of  the  Departure  Preventer-adjusted  pre- 
filter rate  limits  were  set  to  keep  the  stabilator  from  rate  limiting 
for  large,  sharp  pilot  commands. 

In  the  lateral  axis,  as  AOA  increased,  the  Departure  Preventer  reduced 
the  roll  rate  feedback  gain  until  the  limit  AOA  was  reached,  at  which 
time  the  roll  rate  feedback  was  reduced  to  zero  and  the  pilot  had  direct 
proportional  control  over  the  aileron  surface  position.  Under  this 
condition,  full  lateral  stick  inputs  commanded  full  aileron  deflection. 

In  this  way,  lateral  control  was  maintained  using  conventional  pilot 
techniques  without  generating  possible  destablizing  signals  through  the 
feedback  path  as  roll  effectiveness  of  the  ailerons  diminishes  and  yaw 
effectiveness  increases. 

2. 4. 3. 2 Air-to-Air  Combat  - The  control  laws  designed  for  this  mission  segment 
provided  for  rapid  and  precise  maneuvering  at  all  usable  combat  normal  accelera- 
tions, the  ability  to  rapidly  minimize  lateral  offset  errors,  and  the  ability 
to  operate  at  high  AOA  with  command  limiting  to  preclude  loss  of  controlled  flight. 
Two  air-to-air  combat  modes  were  developed  during  the  DFCS  investigations;  one  was 
developed  at  MCAIR  by  modifying  the  Normal  Mode  and  one  was  developed  by  General 
Electric  (G.E.). 

(a)  MCAIR  Air-to-Air  Combat  Mode  (AACM) 

Features 

o Increased  roll  response 
o Improved  high  AOA  performance 
o Reduced  gust  sensitivity 
o Increased  yaw  damping 
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co*t“™  desi  "erhe.S>’"thesl-<l  by  modifying  the  Normal  Mode 

better  air-to-air  t^oklne^'  1^“  °f  provldl"S  faster  responses  and 
Section  2.3.2.  S Pability  using  the  effectiveness  criteria  of 

Modifications  made  to  the  Normal  Mode  longitudinal  control  laws  were: 
o A reduction  in  the  prefilter  time  constant  for  faster  response, 
o Replacement  of  the  normal  acceleration  feedback  with  an  AOA  feedback, 


O Elimination  of  the  DLC  capability. 

The  AOA  feedback,  with  a gain  based  on  the  lift  ei 

normal  acceleration  feedback  at  low  aircraft  angles-of-attMk^T^he 

Sec^eLes8  thrfof  feek  1“*  the  Sl°pe  °f  the  *!«««  lift  curve 
feedback  ,2  a !'?'"  than  the  nl'rmal  acceleration 

of-attack  in  tight  tS^IIES  £ 

feedbac^ar^discussed  In^TotTlsT1^1^  °f  A0A 

Uws”e«“Catl°nS  "ade  C°  the  N°rnal  MOde  lateral -directional  control 

° quicker trolldresponse^era^”aXiS  Prefllter  » provide 

° iU“  °5  the  r"  rate  feedback  8^n  schedule  so  that  the  gain 
lateraraimingaabiUt^1UeS  °f  ^ t0  and 

o Elimination  of  the  lateral  acceleration  feedback  gain  in  order  to 
reduce  the  aircraft  directional  response  to  gusts?  and 

o Elimination  of  the  Lateral  Translation  capability. 

betteriateraf' til  7*  f 3 quickenin8  °f  aircraft  response  and 

better  lateral  air-to-air  tracking.  Figure  22  illustrates  the  roll 

?he  Norma?  Hc< £?'  ^ C°mparl"S  ro11  ™te  <=— buds  for  the  AACM  and 

(b)  G.E.  Air  Combat  Mode  (ACM) 

Features 


o Improved  high  AOA  performance 
o Increased  roll  response 
o Planar  Turn 
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Figure  22 

Normalized  Roll  Axis  Response 


o Lateral  stick  - Controls  plane  of  turn 

o Longitudinal  stick  - Controls  rate  of  turn  in  the  plane 

Longitudinal  stick  commands  appropriate  blend  of  roll  and  pitch 
so  that  turns  are  maintained  in  the  plane  selected  through  the 
lateral  stick. 

The  ACM  was  designed  by  G.E.  as  a subcontractor  participant  in  the  Digital 
FCS  program  and  is  reported  in  Reference  (12).  The  most  unique  feature  of 
this  mode  was  the  pilot  selectable  Planar  Turn  option  in  which  the  lateral 
axis  coupled  to  longitudinal  stick  inputs  at  load  factors  above  two  g to 
maintain  a constant  plane  of  turn.  A complete  description  of  the  design 
of  the  ACM  and  the  Planar  Turn  option  are  found  in  Reference  (12). 

2 . *4 • 3 » 3 Air-to-Ground  Bombing  Mode 


Features 

o Roll  stabilized  about  velocity  vector 
o Neutral  Speed  Stability 
o Direct  Lift  capability 
o Flat  Turn  capability 
o Lateral  Translation  capability 


Reference:  12.  "Digital  Flight  Control  System  Study  Final  Report,"  ACS  10,713, 

General  Electric  Co.,  Binghamton,  N.Y.,  October  1974. 
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The  Air-to-Ground  Bombing  Mode  was  synthesized  to  provide  precise  control 
of  the  aircraft  velocity  vector  using  the  effectiveness  criteria  of  Section  2.3.2 
so  that  good  accuracy  could  be  achieved.  Modifications  to  the  Normal  Mode  control 
laws  were  confined  primarily  to  the  lateral-directional  axes,  with  the  Normal  Mode 
longitudinal  control  law  requiring  changes  to  the  DLC  networks  only  in  order  to 
optimize  the  DLC  capability  for  vernier  corrections  of  the  velocity  vector  at  the 
air-to-ground  bombing  flight  conditions. 

Modifications  made  to  the  Normal  Mode  lateral-directional  control  laws  include: 

o Addition  of  a gravity  correction  term  to  the  yaw  rate  feedback  path  to 
produce  aircraft  roll  rate  stabilized  around  the  velocity  vector  and  yaw 
rate  proportional  to  bank  angle, 

o Elimination  of  the  integral  control  of  sideslip  and  lateral  acceleration, 
o Elimination  of  the  ARI  crossfeed  of  roll  rate  error, 
o Addition  of  the  Flat  Turn  capability,  and 
o Modification  of  the  Lateral  Translation  network. 

All  alterations  to  the  lateral-directional  control  laws  were  made  to  provide  the 
capability  to  roll  about  the  aircraft  velocity  vector  and  to  provide  Lateral  Trans- 
lation and  Flat  Turn  control. 

The  Flat  Turn  and  Lateral  Translation  networks  were  derived  by  cpen  loop 
decoupling  techniques,  so  parameter  scheduling  was  required  for  these  features  over 
the  range  of  bombing  flight  conditions. 

2 . 4 . 3 . 4 Air-to-Ground  Gunnery  Mode 

Features 

o Precise  attitude  tracking 
capability 

o Reduced  rotation  due  to  gusts 

o Roll  stabilized  about  reticle 

o Longitudinal  axis  reconfigures 
to  include  normal  acceleration 
feedback  above  one  g incremental 

The  Air-to-Ground  Gunnery  Mode  was  designed  using  the  effectiveness  criteria 
of  Section  2.3.2.  The  major  requirement  for  the  longitudinal  axis  is  to  provide 
good  pitch  control  and  keep  uncommanded  attitude  excursions  sufficiently  small  so  as 
to  provide  good  pointing  accuracy.  Good  pitch  control  during  air-to-ground  tracking 
was  provided  through  the  use  of  a high  gain  pitch  rate  feedback  control  system. 

The  normal  acceleration  feedback,  included  in  the  Normal  Mode,  was  not  used  in  the 
Air-to-Ground  Gunnery  Mode.  The  elimination  of  the  norma.1,  acceleration  feedback 
from  the  Air-to-Ground  Gunnery  Mode  resulted  in  a stick-force-per-g  gradient  which  is 
a function  of  aircraft  velocity.  This  dependence  on  velocity  caused  stick  lightening 
as  velocity  increased  and  could  result  in  overrotation  into  stall  during  pullout 
maneuvers.  This  danger  was  eliminated  by  reconfiguring  the  longitudinal  axis  to 
include  normal  acceleration  feedback  above  one  g incremental  load  factor.  Possible 


o Neutral  Speed  Stability 
o Direct  Lift  capability 
o Flat  Turn  capability 
o Lateral  Translation  capability 
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transients  resulting  from  reconfiguration  were  minimized  by  adjusting  the  prefilter 
gain  so  that  at  a velocity  of  750  ft/sec,  the  stick-force-per-g  gradient  of  the  Air- 
to-Ground  Gunnery  Mode  was  the  same  with  and  without  the  normal  acceleration  feed- 
back. The  DLC  was  retained  in  the  Air-to-Grounc  Gunnery  Mode  to  allow  the  nulling 
of  small  tracking  errors  without  a change  in  pitch  attitude. 

Modifications  made  to  the  Normal  Mode  lateral-directional  control  laws  include: 

o Addition  of  a gravity  term  to  the  yaw  rate  feedback  to  produce  roll  rate 

stabilized  around  the  gun  reticle  with  turn  rate  proportional  to  bank  angle, 

o Addition  of  the  Flat  Turn  capability,  and 

o Modification  of  the  Lateral  Translation  network. 

All  alterations  to  the  Normal  Mode  lateral-directional  control  laws  were  made  to 
reduce  rotation  due  to  gusts  and  to  provide  the  capability  to  roll  about  the  gun 
reticle,  and  to  provide  Lateral  Translation  and  Flat  Turn  control. 

The  Flat  Turn  and  Lateral  Translation  networks  were  derived  by  open  loop 
decoupling  techniques,  so  parameter  scheduling  was  required  for  these  features  over 
the  range  of  air-to-ground  gunnery  flight  conditions. 

2.4. 3. 5 Manual  Carrier  Lan>)'i'i»  Mode  (MCL) 

Features 


o Selectable  automatic  throttle  holds  19  units  AOA 
o Direct  Lift  capability 
o Direct  Side  Force  capability 
o Improved  turn  coordination 

The  MCL  Mode  was  designed  to  comply  with  the  handling  qualities  criteria  of 
Section  2.4.2.  This  mode  provided  for  pilot  control  of  the  flight  path  with 
thrust  controlled  by  the  automatic  throttle.  The  control  laws  were  also  applicable 
to  cases  where  the  pilot  controlled  both  flight  path  and  thrust. 

The  power-approach  configuration  included  full  flaps,  undrooped  ailerons,  and 
wing  leading  edge  fixed  slats  compatible  with  full  flap  operation.  The  aircraft 
flew  at  19  units  AOA  and  an  airspeed  of  136  knots  with  20%  internal  fuel.  The 
automatic  throttle  system  was  set  to  maintain  a trim  AOA  of  19  units.  Bias  setting 
of  the  horizontal  canards  was  5°  leading  edge  down.  Aircraft  pitch  control  used 
inputs  to  the  stabilator  only.  This  was  done  to  preserve  the  horizontal  canard 
capability  for  DLC. 

The  DLC  system  for  manual  carrier  landing  was  designed  to  meet  the  following 
objectives : 

o Obtain  0.1  g capability, 
o Minimize  pitch  attitude  change, 
o Obtain  rapid  response  of  change  of  altitude,  and 
o Retain  adequate  aileron  authority  for  roll  control. 
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Aircraft  roll  control  for  the  MCL  Mode  used  command  inputs  to  the  ailerons, 
spoilers,  and  rudder.  Turn  coordination  was  provided  by  roll  crossfeed  commands  to 
the  rudder  and  lateral  acceleration  feedback.  The  Lateral  Translation  control  was 
designed  to  obtain  rapid  lateral  acceleration  onset  with  a peak  acceleration  of  at 
least  0.05  g.  The  Lateral  Translation  networks  were  intended  for  use  in  the  landing 
configuration  and  landing  flight  condition  only,  so  variable  networks  were  not 
necessary.  Only  limited  aileron  and  rudder  deflections  were  required  to  provide 
the  Lateral  Translation  capability,  and  sufficient  surface  deflection  capability 
was  retained  to  provide  unimpaired  roll  control. 

2. A. 3.6  Fixed  Canards  Mode 

Features 


o Neutral  Speed  Stability 
o Coordinated  turns 
o Non-operable  canards 

fhe  purpose  of  developing  a Fixed  Canards  Mode  was  to  provide  adequate  control 
capabilities  (Category  2 of  Reference  (6))  in  the  pitch  axis  in  the  event  of  a failure 
in  the  canards  control  paths.  In  the  event  of  a failure,  the  canards  were  automatically 
returned  to  and  fixed  at  5°  leading  edge  down  and  would  no  longer  perform  control 
functions.  The  accompanying  reduction  in  control  power,  without  an  accompanying 
increase  in  static  stability,  required  that  the  Normal  Mode  longitudinal  axis  be 
modified  slightly  to  maintain  stability  and  controllability.  No  alterations  were 
required  for  the  Normal  Mode  lateral-directional  axes  other  than  disabling  the  DSF 
input  paths. 

The  only  modification  to  the  Normal  Mode  required  to  provide  adequate  control 
was  to  fix  the  gain  in  the  forward  path. 

2. 4. 3. 7 DigiPACT  Mode 

Features 


o General  fighter  control  mode 
o Digitized  version  of  PACT  analog  system 

The  DigiPACT  Mode  was  studied  as  an  interim  mode  for  the  Digital  FCS.  The 
DigiPACT  Mode  consisted  of  a digital  implementation  of  the  existing  analog  SFCS- 
PACT  control  laws.  These  control  laws  were  originally  designed  as  a general-purpose 
fighter  control  law  usable  for  all  mission  segments.  The  DigiPACT  Mode  was  included 
to  enable  a comparison  between  a general-purpose  control  law  and  customized  multi- 
modes . 

Other  than  the  digital  implementation  of  the  control  laws,  the  major  difference 
between  the  analog  SFCS-PACT  and  DigiPACT  control  laws  was  the  location  of  the 
integration  function  in  the  longitudinal  axis.  The  integration  was  required  in  the 
longitudinal  axis  to  provide  the  NSS  capability.  The  NSS  was  obtained  in  the  analog 
control  laws  by  utilizing  a washout  in  the  feedback  signal  around  the  secondary 
actuator.  The  DigiPACT  Mode  utilized  an  integration  in  the  forward  path. 
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2-4,3*8  Cgncjjjsion  - Eight  pilot-assist  modes  were  developed  and  analyzed  to  assess 
the  feasibility  and  desireability  of  incorporating  into  the  Digital  FCS  customized 
multimodes  which  integrate  aircraft  control  with  mission  demands.  These  modes 
were  later  evaluated  and  refined  based  on  qualitative  pilot  opinion  and  quantitative 
wor  load  and  effectiveness  data  obtained  during  two  man-in— the- loop  simulations. 

The  results  of  the  simulation  evaluation  are  presented  in  Sections  2.19,  2.20  and 


2.4.4  AUTOMATIC  (PILOT-RELIEF)  MODES 


Conventional  Pilot-Relief  Modes 

o 

Automatic 

Throttle 

o 

Pitch  Attitude  Hold 

0 

Au tomatic 

Carrier  Landing 

0 

Roll  Attitude  or  Heading  Hold 

o 

Automatic 

ILS 

o 

Preselect  Heading 

0 

Automatic 

Navigation 

o 

Altitude  Hold 

o 

Automatic 

Energy  Management 

The  feasibility  and  desirability  of  incorporating  into  the  ADP  various  mission- 
oriented  pilot-relief  modes  were  investigated.  As  a result,  the  above  pilot-relief 
modes  were  developed  to  provide  automatic  control  of  flight  path  and  other  flight 
parameters  to  relieve  pilot  workload  and  improve  mission  ef fectivensss. 

2. 4. 4.1  Conventional  Pilot-Relief  Modes 

Features 


o Holds  altitude  or  pitch  attitude  existing  at  engagement 
o Holds  roll  attitude  or  heading  existing  at  engagement 
o Captures  and  holds  heading  selected  by  the  pilot 

The  Normal  Mode  was  used  as  the  inner  loop  for  the  Conventional  Pilot-Relief 
Modes,  with  pitch  attitude,  roll  attitude  and  heading  obtained  from  an  Inertial 
Navigation  System  and  altitude  from  the  Central  Air  Data  Computer.  The  Pitch  Atti- 
tude Hold,  and  Roll  Attitude  or  Heading  Hold  Modes  could  be  engaged  any  time  the 
aircraft  attitude  was  between  +70  degrees.  Application  of  longitudinal  or  lateral 
stick  force  interrupted  the  Pitch  Attitude  Hold  and  Roll  Attitude  or  Heading  Hold 
Modes  and  returned  control  to  the  pilot  via  the  Normal  Mode.  The  subsequent 
release  of  the  stick  reengaged  the  mode  at  the  new  aircraft  attitude.  Control  law 
logic  based  on  roll  attitude  determined  whether  the  system  held  roll  attitude  or 
heading.  The  aircraft  automatically  held  the  present  heading  if.  the  roll  attitude 
was  less  than  5 degrees,  and  held  the  present  roll  attitude  if  it  was  between  5 and 
70  degrees. 

The  Preselect  Heading  Mode  caused  the  aircraft  to  automatically  fly  to,  capture, 
and  hold  a new  heading  selected  on  the  CDC.  Logic  controlled  the  direction  in  which 
the  aircraft  turned  to  capture  the  new  heading,  with  the  maximum  roll  attitude 
limited  during  the  turn. 

The  Altitude  Hold  Mode  included  an  "up  stabilator  command"  as  a function  of 
bank  angle  to  provide  improved  altitude  hold  capability  during  turns.  This  command 
was  based  on  the  theoretical  expression  for  the  pitch  rate  gyro  signal  in  a coordi- 
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nated  turn.  Switching  logic  was  provided  to  prevent  Altitude  Hold  from  being 
engaged  unless  the  vertical  velocity  was  less  than  1000  ft/min  to  minimize  the  g 
engage  forces. 

2. 4. 4. 2 Automatic  Throttle  Mode 
Features 


o Provides  Mach  hold  in  the  up-and-away  configuration 
o Holds  AOA  at  19  units  in  _he  gear-down  configuration 
o Allows  manual  pilot  override 

o Automatically  disengages  when  the  pilot  moves  the  throttle  into  the  A/B 
range  in  the  gear-down  configuration 

o Requires  manual  positioning  into  and  out  of  the  A/B  range  in  the  up-and-away 
configuration 

o Cockpit  throttle  levers  automatically  follow  engine  cambox  servo  signals 

The  Automatic  Throttle  Mode  provided  Mach  hold  for  the  Normal  Mode  gear-up  con- 
figuration, velocity  and  acceleration  control  for  the  Automatic  Energy  Management 
Mode,  and  Approach  Power  Compensation  for  the  Normal,  MCL,  ACL,  and  Automatic  ILS 
Modes.  In  the  latter  capacity,  the  Automatic  Throttle  Mode  held  19  units  AOA  except 
when  DLC  was  being  used.  The  DLC  produced  an  AOA  reference  change  in  the  Automatic 
Throttle  Mode  that  kept  the  Automatic  Throttle  from  returning  the  aircraft  to  the 
19  unit  reference  until  DLC  commands  were  removed.  If  the  AOA  reference  were  not 
changed,  the  automatic  throttle  would  have  washed  out  the  effects  of  the  DLC. 

Control  law  logic  was  provided  to  keep  the  throttles  from  transitioning  into  or 
out  of  the  A/B  range  without  pilot  intervention.  A signal  was  displayed  on  the  HUD 
indicating  to  the  pilot  whether  the  A/B  or  MIL  power  range  was  needed,  and  after  the 
pilot  made  the  transition,  automatic  thrust  modulation  was  resumed.  In  the  geardown 
configuration,  any  manual  transition  to  the  A/B  range  automatically  disengaged  the 
Automatic  Throttle  Mode.  This  mode  was  also  disengaged  by  the  actuation  of  either 
the  gear  or  the  speed  brake. 

2.4.4. 3 Automatic  Carrier  Landing  (ACL)  Mode 

Features 


o Blended  DLC  and  pitch  attitude  commands 
o Blended  DSF  and  roll  attitude  commands 

o Deck  Motion  Compensation  (DMC),  or  deck  chasing,  compensated  for  vertical 
deck  motions  of  up  to  16  ft  peak-to-peak 

o Reduced  AOA  excursions  as  compared  to  present  F-4J  AOLS 

The  DFCS  ACL  control  laws  included  a blended  DLC  and  pitch  attitude  command, 
and  a blended  DSF  and  roll  attitude  command  not  incorporated  in  present  fleet  ACL 
systems. 


The  use  of  the  blended  system  for  the  "test  case"  aircraft  resulted  in: 

o A reduction  in  the  flight  path  angle  time  constant, 

o A reduction  in  AOA  changes  to  near  zero  in  response  to  small  pitch  commands, 

o A reduction  in  the  required  thrust  change  to  maintain  the  reference  AOA, 
and 

o The  elimination  of  the  initial  reversal  of  vertical  and  lateral  acceleration 
at  the  aircraft  eg  at  the  onset  of  a command. 

The  blended  DLC  and  DSF  system  required  a different  SPN-42  control  law  which 
was  further  modified  by  the  addition  of  DMC.  The  DMC  computations  were  accomplished 
in  the  simulated  SPN-42  digital  computer  using  data  from  the  simulated  shipboard 
accelerometer  and  gyro  sensors.  The  system  has  shown  good  stability  and  flight  path 
control  under  automatic  carrier  approach  with  a simulated  vertical  deck  motion  of  as 
much  as  16  ft  peak-to-peak  and  a period  of  10  seconds.  During  these  simulations, 
the  aircraft  maintained  a steady  flight  path  down  to  3000  ft  from  the  touchdown 
point.  Within  3000  ft,  the  system  began  deck  chasing,  allowing  the  hook  to  get  in 
phase  with  the  deck  in  less  than  1/2  cycle  and  continued  to  follow  the  deck  motion 
to  touchdown.  Because  of  the  blended  DLC,  AOA  excursions  during  the  final  deck 
chasing  portion  of  the  approach  were  about  +0.4  degrees.  This  compares  with  +3.0 
degrees  for  the  present  F-4J  ACLS  under  the  identical  deck  motion  conditions. 

2. 4. 4. 4 Automatic  Instrument  Landing  System  (ILS)  Mode 

Features 


o Capable  of  capturing  the  glide  slope  from  above 

o Holds  altitude  until  the  glide  slope  is  intercepted  when  capturing  the  glide 
slope  from  below 

o Remains  well  within  the  allowable  35  microamp  overshoot  of  the  glide  slope 
centerline  and  the  37.5  microamp  overshoot  of  the  localizer  centerline  as 
specified  in  Reference  (13) 

o Uses  the  extensive  computational  capability  of  the  Digital  FCS  to  blend  ILS 
signals  with  on-board  roll  attitude  and  normal  acceleration  signals  per- 
mitting a higher  gain  system  which  results  in  good  capture  and  tight  flight 
path  control 

The  control  laws  of  the  Automatic  ILS  Mode  developed  for  the  "test  case"  air- 
craft utilized  the  same  attitude  command  loops  used  for  the  ACL  Mode  with  the 
exception  that  the  DLC  and  DSF  blended  system  of  the  ACL  Mode  was  not  incorporated 
into  the  Automatic  ILS  Mode. 


Reference:  13.  MIL-F-9490D  (Draft)  Flight  Control  Systems-Design,  Installation 

and  Test  of  Piloted  Aircraft,  General  Specification  for,  March 
1974. 
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A vertical  error  from  the  glide  slope  beam  was  computed  from  the  elevation 
angle  error  and  aircraft  altitude  above  touchdown.  This  signal  was  blended  with 
airrraf t normal  acceleration  and  filtered  to  produce  the  pitch  attitude  command  that 
directed  the  aircraft  to  the  glide  slope  centerline.  The  ILS  azimuth  angle  error 
was  blended  with  aircraft  roll  attitude  and  filtered  to  produce  the  roll  attitude 
command  which  steered  the  aircraft  to  the  localizer  beam  centerline  at  a closure 
rate  proportional  to  the  azimuth  error.  Both  the  pitch  and  roll  command  signal 
paths  include  integral  gains  which  eliminated  system  bias  errors. 

The  filters  on  the  attitude  commands  produced  smooth  and  accurate  path  position 
and  rate  data,  even  when  operating  with  a simulated  ILS  ground  installation  having  a 
large  amount  of  beam  errors  due  to  noise,  beam  bends,  discontinuities,  etc. 

The  automatic  ILS  configuration  developed  for  the  "test  case"  aircraft  provided 
fully  automatic  Category  I (Reference  (9))  ILS  approaches,  commencing  at  a point  out- 
side the  ILS  outer  marker  when  the  aircraft  was  within  the  cockpit  indicated  limits 
of  the  ILS  Localizer  Signal.  An  altitude  hold  feature  was  incorporated  to  maintain 
the  engage  barometric  altitude  until  intersection  of  the  ILS  glide  slope  beam. 
Automatic  control  continued  until  reaching  the  ILS  middle  marker,  which  occurred  at 
an  altitude  of  200  ft.  The  system  then  disengaged,  and  the  landing  was  completed 
by  the  pilot.  System  performance  was  well  within  the  Reference  (9)  FAA  requirements. 

2. 4. 4. 5 Automatic  Navigation  Modes 

Features 


o Acquired  and  tracked  horizontal  and  vertical  flight  paths  defined  by  the 
flight  management  computer 

o Minimized  overshoot  during  track  capture  maneuvers 
o Smoothly  transitioned  from  one  flight  path  segment  to  another 

An  automatic  vertical  and  lateral  navigation  capability  was  developed  utilizing 
steering  commands  generated  by  the  Collins  ANS-70A  computer  and  interfaced  with  air- 
craft pitch  and  roll  attitude  and  the  DFCS  Normal  Mode  contol  laws.  Logic  in  the 
interface  with  the  DFCS  control  laws  provided  for  disengagement  of  the  Automatic 
Navigation  Modes  with  stick  force,  and  system  reconfiguration  to  the  attitude  hold 
modes. 

2. 4. 4. 6 Automatic  Energy  Management  Mode 
Features 

f 

o Minimum  Time,  Minimum  Fuel,  and  Maximum  Range  energy  ascent  paths 

o Maximum  and  Maximum  Dynamic  Pressure  energy  descent  paths 

o "Energy  Look  Ahead"  implementation  smooths  flight  paths  and  avoids  high  load 
factors 

An  automatic  Energy  Management  (EM)  Mode  was  designed  for  the  "test  case"  air- 
craft with  the  capability  of  flying  three  basic  optimum  energy  ascent  flight  paths 
and  two  energy  descent  paths.  The  capabilities  provided  were  flexible  enough  for  a 
variety  of  optimum  mission  segments  to  be  flown  automatically  with  pilot  selection 
of  the  various  available  flight  paths  or  with  proper  merging  of  target  acquisition 
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calculations  and  radar  sensing.  Studies  of  the  energy  characteristics  of  the  test 
case"  aircraft  revealed  that  optimum  flight  paths  computed  with  a variable  throttle 
setting  were  substantially  the  same  as  optimum  flight  paths  computed  with  fixed 
throttle  settings  with  very  little  penalty  for  using  the  fixed  throttles.  Since 
implementing  optimum-path-following  with  variable  throttle  would  have  been  more  com- 
plex, optimum  flight  paths  with  fixed  throttle  were  utilized  in  the  system,  although 
variable  throttles  were  used  for  capturing  end-point  flight  conditions  and  for  main- 
taining proper  velocities  and  accelerations  in  the  high  speed  descents.  Simplified 
all-digital  simulations  were  used  to  check  the  EM  system  performance  in  the 
development  stages. 

The  basic  optimum-flight -path-capture  method  employed  in  the  EM  system  was 
developed  in  earlier  MCAIR  EM  studies.  It  is  basically  an  "energy  look-ahead" 
method  which  is  described  in  Reference  (14). 

In  implementing  the  control  laws  to  follow  the  commanded  flight  paths,  the 
flight  path  commands  were  converted  to  load  factor  commands.  This  conversion  was 
used  for  two  reasons: 

o It  was  very  convenient  to  convert  the  load  factor  feedback  loop  of  the 

Normal  Mode  to  a load  factor  control  path  by  integrating  load  factor  error, 
and 

o It  was  desirable  to  place  load  factor  limits  on  the  flight  path  commands  to 
avoid  severe  energy  penalties  from  high  load  factor  maneuvers.  Thus,  load 
factor  commands  were  conveniently  limited  in  the  EM  calculation  prior  to 
transmission  to  the  control  law  calculation. 

Digital  logic  was  developed  to  perform  the  EM  calculation,  provide  adequate 
limits  on  control  loop  input  commands,  perform  switching  among  selected  optimum 
flight  paths,  and  coordinate  flight  path  and  throttle  settings  for  capturing  end- 
point flight  conditions  on  or  off  the  optimum  paths.  End-point  captures  were  made 
by  following  approximately  constant  energy  flight  paths  from  the  optimum  flight 
paths.  All  path-following  functions  were  developed  using  the  basic  look-ahead 
scheme  described  in  Reference  (14)  or  minor  modifications  of  the  scheme.  The  over- 
all results  of  this  mechanization  was  a system  which  follows  optimum  flight  paths 
very  well  and  which  smooths  discontinuities  associated  with  theoretical  optimum 
flight  paths  or  intersections  of  flight  paths. 

2 . 4 . 4 . 7 Conclusion  - Nine  pilot-relief  modes  were  developed  and  analyzed  to  assess 
the' feasibility  and  desireability  of  incorporating  into  the  Digital  FCS  customized 
control  modes  which  provided  automatic  control  of  flight  path  and  other  flight 
parameters  to  reduce  pilot  workload.  These  pilot-relief  modes  were  later  evaluated 
and  refined  based  on  qualitative  pilot  opinion  and  quantitative  workload  data 
obtained  during  the  Integrated  Control  Law  and  Display  Simulation  in  which  evalua- 
tion pilots  flew  individual  mission  segments  and  a complete  mission  scenario. 

The  results  of  these  evaluations  are  presented  in  Sections  2.20  and  3.3. 


Reference:  14.  Report  in  Writing:  "Interface  of  Throttle/Energy  Management 

Function  with  DAIS  System  for  Fighter  Aircraft",  March  1975 
(Report  Number  not  yet  available)  Contract  No.  F33615-74-C-3103. 
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2.4.5  GAIN  CHANGING  - The  design  of  the  DFCS  pilot-assist  and  pilot-relief  mode 
control  laws  included  gain  changing  to  improve  handling  qualities  as  described  in 
Section  2.3.2  and  effectiveness  as  described  in  Section  2.4.2  over  the  range  of 
design  flight  conditions.  The  five  classifications  of  gain  changing  that  were 
considered,  in  order  of  decreasing  complexity,  are: 

o Self  adaptive  gain  changing, 

o Air  data  gain  scheduling, 

o Ordinary  non-linearities  (deadband,  limits,  etc.), 

o Automatic  gain  switching  with  control  mode  or  configuration  changes,  and 

o Manual  gain  changing. 

Self  adaptive  gain  changing  was  considered  as  a possible  method  of  providing 
gain  adjustments  to  compensate  for  the  wide  range  of  aircraft  dynamics  encountered 
over  the  flight  envelope.  These  gain  changing  schemes  are  generally  active  schemes 
since  practical  implementation  of  the  aircraft  dynamics  identification  process 
usually  requires  a periodic  excitation  of  the  airframe  by  an  automatic  control  sur- 
face input  device  and  measurements  of  the  resulting  response.  Most  of  the  available 
identification  methods  also  require  that  a set  of  rather  complex  computations  be 
performed  constantly  so  that  gain  changes  can  be  updated  quickly  to  prevent  degra- 
dation of  stability  margins  and  performance  with  rapid  variations  of  flight  condi- 
tions. Development  of  the  multimode  DFCS  control  laws  revealed  that  gain  changing 
requirements  would  be  more  numerous  than  in  a single  mode  design  if  the  full  multi- 
mode  capability  was  to  be  exploited.  Self  adaptive  gain  changing  is  generally  an 
order  of  magnitude  more  complex  than  air  data  gain  scheduling.  This  complexity 
coupled  with  some  uncertainties  about  the  applicability  of  current  identification 
schemes  for  identifying  unstable  CCV  aircraft  dynamic  parameters  prompted  design 
efforts  to  avoid  adaptive  gain  changing  if  alternative  air  data  scheduling  would 
provide  good  system  performance.  It  was  found  that  air  data  scheduling  of  gains 
was  a satisfactory  method  of  gain  changing  for  the  multimode  control  laws.  There- 
fore, the  self  adaptive  methods  are  not  recommended  for  the  currently  defined  DFCS 
control  system. 

Table  2 is  a preliminary  list  of  the  air  data  scheduled  gains  recommended 
for  use  in  the  DFCS  control  system.  These  gain  changing  elements  are  passive  in 
that  airframe  dynamic  excitation  is  not  required  for  the  gain  changes  to  be  effected. 
Aerodynamic  or  control  parameters  are  measured  passively , and  the  gain  changes 
are  determined  using  schedules  which  are  stored  in  the  flight  control  computers 
and  which  require  relatively  simple  calculations  for  the  desired  gain  determinations. 
The  redundancy  considerations  for  air  data  gain  scheduling  are  discussed  in 
Section  2.16.3.  In  addition  to  air  data  scheduling,  ordinary  nonlinearities  and 
automatic  gain  switching  with  mode  or  configuration  changes  are  recommended  for 
performing  adjustment  of  many  gains  not  requiring  continuous  change  with  flight 
condition.  Manual  gain  changing  is  reserved  for  use  in  the  event  of  certain  fail- 
ures of  air  data  scheduled  gains. 

Gain  changing  systems  should  be  implemented  with  the  redundancy  of  the  control 
loops  containing  them.  The  gains  associated  with  the  Normal  Mode  must  remain 
operational  at  all  times  for  reasons  of  flight  safety  and  for  use  for  mission  com- 
pletion in  the  event  of  a failure  of  one  of  the  specialized  modes.  It  is  planned 
that  pilot  selectable  gain  changing  will  be  available  for  emergency  use  in  the  event 
that  automatic  gain  changing  equipment  associated  with  the  Normal  Mode  should  fail. 
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Table  2 

Air-Data  Scheduled  Gains 


Forward  Loop  Gains1 

Energy  Management  Load  Factor  Gain 

Departure  Preventer  Gains 

Yaw  Rate  and  Sideslip  Feedback  Gains1 

ARI  Gains1 

Lateral  Translation  and  Flat  Turn  Network  Gains 
Automatic  Navigation  Outer  Loop  Gains 


Note:  1 . Gains  Associated  with  the  Normal  Mode 


Conclusion  - Gain  changing  is  required  in  the  Digital  FCS  to  improve  handling 
qualities  and  effectiveness  over  the  wide  range  of  flight  conditions  and  variety  of 
mission  segments  flown.  Efforts  to  simplify  gain  changing  resulted  in  eliminating 
self-adaptive  techniques  and  minimizing  air  data  gain  scheduling  in  favor  of 
ordinary  nonlinearities  and  gains  changed  automatically  with  configuration  or  mode 
changes.  Manual  gain  changing  was  reserved  for  use  only  as  a backup  in  the  event 
of  failure  of  certain  air  data  scheduled  gains  as  discussed  in  Section  2.16.3. 

2.4.6  MODE  COMPATIBILITY  AND  MODE  SWITCHING  - Implementation  of  the  pilot-assist 
modes  and  the  pilot-relief  modes  in  the  DFCS  required  defining  mode  compatibility 
and  mode  switching  strategies.  The  criteria  was  to: 

o Accomplish  control  law  changes  without  objectionable  transients, 

o Simplify  switching  through  integrated  flight  control  mode  and  display 
switching,  and 

o Provide  means  for  automatic  and/or  pilot  selection  of  each  mode  in  a manner 
compatible  with  safety  and  the  use  for  which  the  mode  was  intended. 

Figure  23  is  the  mode  compatibility  chart  for  the  pilot-assist  and  pilot-relief 
modes.  Switching  between  the  modes  was  accomplished  manually  using  the  Computer  and 
Display  Controller  (CDC)  and  switches  on  the  throttles  and  SSC,  or  automatically  if 
prescribed  events  occurred. 

The  following  arrangement  for  manual  mode  selection  of  flight  control  modes 
was  employed: 

(a)  All  the  pilot-assist  and  pilot-relief  modes  except  ACL  and  Auto- 
matic ILS  were  engaged  directly  through  the  CDC. 

(b)  Selecting  ACL  or  Automatic  ILS  on  the  CDC  initiated  the  arming  sequence 
of  these  modes.  Once  armed,  ACL  was  engaged  manually  with  the  Data  Link 
Coupler  switch  when  the  "CPR  ON"  command  appeared  on  the  HUD,  and  Auto- 
matic ILS  was  engaged  automatically. 
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Pilot  - 
Assist 
Modes 


Pilot  - 
Relief 
Modes 


C = Compatible 
N = Not  Compatible 


' Fixed  Canards 
Normal 

Air-to-Ground  Gunnery 
Air-to-Ground  Bombing 
Air-to-Air  Combat 
. Manual  Carrier  Landing 
Automatic  Attitude  Hold 
Automatic  Altitude  Hold 
Automatic  Throttle 
Automatic  Carrier  Landing 
Automatic  Energy  Management 
Automatic  Vertical  Navigation 
Automatic  Lateral  Navigation 
Automatic  ILS 


Assist  Modes 


Pilot-Relief  Modes 


Notes:  1 . Automatic  Altitude  Hold,  Automatic  Energy  Management  and  Automatic  Vertical 
Navigation  are  compatible  with  Roll  Attitude  and  Heading  Hold  and  not 
compatible  with  Pitch  Attitude  Hold 

2.  Automatic  Lateral  Navigation  is  compatible  with  Pitch  Attitude  Hold  but  not 
compatible  with  Roll  Attitude  and  Heading  Hold 

3.  Automatic  Altitude  Hold  can  be  used  with  ACL  or  Automatic  ILS  and  will  be 
automatically  disengaged  when  the  aircraft  reaches  the  glide  slope  centerline 

4.  The  Automatic  Throttle  is  an  integral  part  of  the  ACL  and  Automatic  Energy 
Management  Modes 


Figure  23 

Mode  Compatibility  Chart 

(c)  In  addition  to  selection  through  the  CDC,  the  Air-to-Air  Mode  was  engaged 
through  the  Air-to-Air  Mode  Selection  switch  mounted  on  the  throttle,  and 
the  Normal  Mode  was  engaged  through  the  Normal  Flight  Mode  switch  on  the 
SSC.  These  additional  means  of  mode  selection  made  these  modes  available 
to  the  pilot  without  moving  his  hands. 

A summary  of  the  automatic  mode  switching  implementation  is  presented  in 
Table  3. 

The  mode  switching  strategies  developed  for  switching  from  one  mode  to  another 
produced  smooth  changes  without  objectionable  transients  during  both  the  manual  and 
automatic  mode  switching.  In  general,  where  feedback  variables  and  command  signals 
were  engaged  or  disengaged,  fade  circuits  were  employed  to  eliminate  any  objection- 
able transients.  The  transition  time  of  2.5  seconds,  associated  with  these  fade 
circuits,  was  such  that  the  pilot  could  compensate  for  any  changes  in  stick  force 
required  to  sustain  the  desired  maneuver. 

Conclusion  - These  switching  strategies  were  incorporated  into  the  control  laws 
and  evaluated  by  the  simulation  pilots  during  both  the  Control  Law  Simulation  and 
the  Integrated  Control  Law  and  Display  Simulation.  This  method  of  reducing  tran- 
sients during  mode  transition  was  successfully  flown  in  the  SFCS  flight  test  program 
to  switch  among  the  Normal,  Electrical  Back-Up  and  Mechanical  Back-Up  modes. 
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Table  3 


Automatic  Mode  Switching  Summary 


Mode  Disengaged 

Mode  Engaged 

Switching  Circumstances 

Energy  Management 

Altitude  Hold  with 
Automatic  Throttle 

Either  Desired  Altitude  or  Desired 
Mach  Number  Acquired 

Any  Mode 

ILS 

ILS  Armed  and  Aircraft  within 
± 0.7°  of  Glide  Slope  Centerline  and 
± 2.5°  of  Localizer  Centerline 

Pitch  Attitude  Hold 

Normal  Mode 

Pitch  Attitude  Exceeds  ± 70° 

Roll  Attitude  Hold 

Normal  Mode 

Roll  Attitude  Exceeds  ± 70° 

Roll  Attitude  Hold 

Heading  Hold 

Roll  Attitude  Between  —5°  and  +5° 

Energy  Management 

Normal  Mode 

Application  of  Pitch  Stick  Force 

Altitude  Hold 

Normal  Mode 

Application  of  Pitch  Stick  Force 

ILSor  ACL 

Normal  Mode 

Application  of  Pitch  or  Roll 
Stick  Force 

Vertical  Auto  Nav 

Pitch  Altitude  Hold 

Application  of  Pitch  Stick  Force  or 
Lateral  Auto  Nav  Disengagement 

Lateral  Auto  Nav 

Roll  Altitude  Hold 

Application  of  Roll  Stick  Force 

Automatic 

Throttle 

ACL  or 

Manual  Throttle 

Lowering  or  Raising  Gear  or  Actuation 
of  the  Speed  Brake  Switch  or  After- 
burner Selected  with  Gear  Down 

Energy  Management 

Normal  Mode 

Automatic  Throttle  Disengagement 

SKEWED  RATE  SENSORS  — PHASED  TEST  PROGRAM  — A program  for  incorporating  into 
the  DFCS  test  aircraft  a set  of  angular  rate  gyro  sensors,  that  are  skewed  with 
respect  to  the  aircraft  control  axes,  has  been  defined  to  enable  installation  and 
test  of  the  skewed  sensors  in  a phased  flight  test  program.  The  potential  advantage 
of  skewed  sensors  is  that  each  sensor  can  provide  angular  rate  information  for  more 
than  one  control  axis,  with  the  result  that  fewer  sensors  would  be  required  to 
achieve  any  given  level  of  sensor  redundancy.  The  phased  program  has  been  defined 
to  initially  use  the  existing  rate  gyros  for  vehicle  control  and  concurrently 
record  the  output  signals  from  the  separate  skewed  gyros  for  subsequent  analysis. 
After  confidence  is  gained  in  the  in-flight  operation  of  the  skewed  sensors,  these 
sensors  would  be  employed  for  closed-loop  control. 


Task  descriptions  of  the  phased  program  for  in-flight  testing  and  operation  of 
a set  of  skewed  rate  sensors  are  outlined  below: 

Phase  and  Task  Description: 

Phase  I:  Development  and  In-Flight  Open  Loop  Evaluation 

o Define  installation  locations  for  the  skewed  rate  sensors. 

o Detail  design  of  aircraft  and  equipment  modification  for  the  in-flight 
selection  of  the  skewed  rate  sensors  and  for  simulated  failure 
insertion  on  a per-axis  basis. 
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o Perform  analysis  to  define  a suitable  structural  filter  for  each 
skewed  rate  sensor. 

o Write  the  computer  software  programs  for: 
o The  structural  filters,  and 

o The  redundancy  management  and  coordinate  equations  which  extract 
pitch  rate,  roll  rate  and  yaw  rate  information  from  the  skewed 
sensors  and  perform ' failure  detection,  failure  isolation  and  system 
reconfiguration. 

o Program  the  digital  flight  computers  and  conduct  bench  tests  of  the 
individual  computers. 

o Conduct  a system  bench  test  with  the  redundant  computers  married  to 
the  skewed  rate  sensors. 

o Install  the  skewed  rate  sensor  package  and  associated  equipment  into 
the  aircraft. 

o Conduct  open  and  closed  loop  ground  tests  of  the  installed  equipment. 

o Conduct  5 flights  with  the  skewed  rate  sensors  operating  off-line  to 
evaluate: 


o Thu  skewed  rate  sensor  pitch  rate,  roll  rate  and  yaw  rate  data, 

o The  effectiveness  of  the  structural  filters,  and 

o The  failure  detection,  failure  isolation  and  reconfiguration 
routines  for  pilot  inserted  simulated  failures. 


Phase  II:  Initial  In-Flight  Closed  Loop  Evaluation 


o Modify  structural  filter  design  as  necessary  based  on  Phase  I flight 
test  results. 

o Conduct  5 flights  to  evaluate  the  modified  structural  filters  operating 
off-line . 


o Conduct  5 flights  during  which  the  pilot  selects  on  a per-axis  basis 
between  the  skewed  rate  sensors  and  normal  aircraft  sensors  for  closed 
loop  control  in  all  flight  control  modes. 

Phase  III:  Continued  In-Flight  Closed  Loop  Evaluation 

o Conduct  5 flights  using  the  skewed  rate  sensors  exclusively  throughout 
the  flight  envelope  and  in  all  flight  control  modes  from  takeoff  to 
touchdown. 

o Prepare  a final  report  documenting  the  results  of  the  skewed  rate  sen- 
sor test  program. 
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Conclusion  - A phased  program  was  defined  for  the  in-flight  testing  of  a set  of 
skewed  rate  sensors.  This  program,  as  presented,  is  contingent  upon  receiving  from 
t e Government  the  sensor  configuration  and  redundancy  management  and  coordinate 
equations  required  for  implementing  a set  of  skewed  rate  sensors  into  an  aircraft 
for  closed  loop  fly-by-wire  control  applications. 


2.5  ELECTRICAL  BACKUP  (EBU) 

For  purposes  of  this  analysis,  EBU  was  defined  as  a mode  which  allows  the  pilot 
to  command  surface  position  rather  than  aircraft  motion  without  the  use  of  rate  or 
acceleration  feedbacks. 

The  three  sound  candidate  configurations,  which  were  evaluated  in  the  relia- 
bility analysis  reported  in  Section  2.17,  all  met  the  Statement  of  Work  reliability 
goal  without  an  EBU,  although  safety  and  reliability  are  improved  if  satisfactory 
performance  can  be  provided  by  an  EBU  mechanization. 

An  EBU,  as  defined  above,  cannot  control  the  pitch  motion  of  an  aircraft  such 
as  F-4  S/N  12200  with  horizontal  canards,  when  the  basic  airframe  is  unstable,  and 
the  control  frequency  is  too  high  for  the  pilot  to  handle  without  pitch  rate  feed- 
back. Accordingly,  it  is  not  planned  that  a pitch  EBU  will  be  used  in  the  Digital 
FCS. 

Safety  is  improved  if  an  EBU  is  provided  in  the  lateral-directional  axes  and 
it  is  anticipated  that  satisfactory  lateral-directional  handling  qualities  can  be 
provided  by  an  EBU  (without  rate  feedback).  Accordingly,  an  EBU  may  be  provided 
as  a reconfiguration  capability  of  the  Normal  Mode  for  the  lateral-directional 


axes . 


2.6  PILOT  INTERFACE 
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2.6.1  INTRO DUCT  ION  - An  analysis  was  performed  to  determine  the  pilot  interface 
with  the  Digital  FCS.  Each  function  identified  was  evaluated  to  determine  how  it 
would  be  performed.  Information-processing,  decision-making  and  action  functions 
were  allocated  to  the  pilot,  tc  a machine,  or  to  a man-machine  combination.  Pilot 
tasks  were  assessed  in  terms  of  time-to-perform  versus  time  available  in  each 
mission  segment.  Information  gleaned  from  these  analyses  was  used  in  the  evalua- 
tions discussed  below. 

2.6.2  PROCEDURES  AND  TACTICS  - The  procedures  and  tactics  identified  were  derived, 
in  part,  from  current  Air  Force  course  materials  used  for  pilot  upgrading  into 
advanced  fighter  aircraft.  Modifications  to  existing  procedures  and  tactics  dis- 
cussed herein  are  based  on  the  evaluation  of  the  aircraft  aerodynamic  control  capa- 
bility, dynamic  simulation  results,  and  pilot  opinion  data.  Paragraph  2. 6.2.1  below 
outlines  the  unique  capabilities  of  the  Digital  FCS  and  the  discussion  in  Paragraphs 

2. 6. 2. 2 through  2. 6. 2. 7 describe  the  effects  of  the  increased  control  capability, 
afforded  by  this  system,  on  conventional  pilot  procedures  and  tactics. 

2.6.2. 1 Unique  Flight  Qualities  of  the  DFCS  Aircraft 


o Aircraft  handling  qualities  are  not  affected  by  eg  variations  over  a Wide 
range,  such  as  might  result  from  various  weapon  loads.  The  conventional 
aircraft  becomes  progressively  more  difficult  to  control  and  would  be  uncon- 
trollable at  aft  eg' s where  no  degradation  would  occur  with  the  DFCS. 

o Increased  acceleration,  turn  rate,  climb  capability  (better  Pg,  energy  level) 
o Greatly  reduced  buffet  at  high  angles  of  attack, 
o Wing  rock  at  high  angles-of-attack  virtually  eliminated,  and 
o Control-limited  load  factor  increased  at  supersonic  speeds. 

o Unique  maneuvering  capabilities  for  weapon  delivery  modes  in  that  the 
aircraft  can: 

o Gain  or  lose  altitude  in  a constant  pitch  attitude, 
o Turn  flat  without  rolling  or  side  slipping,  and 
o Translate  laterally  without  rolling  or  changing  heading. 


o For  air-to-ground  gunnery,  using  conventional  control  inputs,  the  aircraft  will 
roll  about  any  selected  aircraft  axis  thus  eliminating  the  pendulum  effect. 

o For  the  Air  Combat  Mode,  fuselage  aiming  provides  a capability  to  maintain 
the  aircraft  flight  path  while  changing  the  pitch  attitude  and/or  heading. 

o The  Departure  Preventer  inhibits  the  aircraft  from  exceeding  its  structural 
limits.  Sensors,  such  as  angle-of-attack  and  acceleration,  act  as  limiters 
on  the  aircraft  control  which  prevent  overstressing  of  the  aircraft  struc- 
ture and  prevent  aircraft  departures. 
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2. 6. 2. 2 Aircraft  and  Tanker  Hook-up  - The  current  procedure  requires  the  pilot  to 
move  to  the  contact  position,  when  cleared  by  the  boom  operator,  and  stabilize  the 
aircraft  within  two  or  three  feet  of  the  contact  position.  The  air  refueling 
director  lights  and  refueling  boom  extension  must  be  monitored  while  maintaining 
precise  refueling  position.  In  conventional  fighter  aircraft,  the  precise  maneuver- 
ing of  the  receiving  aircraft  to  the  contact  position  requires  a series  of  up  or 
down  pitch  movements  to  match  the  tankers  altitude  and  rudder  induced  rolls  to  match 
the  tankers  line  of  flight.  Each  of  these  flight  changes  entails  a double  attitude 
change  (pitch  up  or  down  and  level  off,  roll  in  and  roll  out)  for  altitude  and 
lateral  deviation  corrections.  With  the  DFCS,  the  pilot  initially  needs  only  to 
match  the  tanker's  airspeed  and  position  his  aircraft  within  a cone  of  some  appro- 
priate dimensions  below  and  behind  the  tanker.  From  this  position  he  can  control 
his  airspeed  with  the  throttle  and  translate  up  or  down,  left  or  right,  using  Direct 
Lift  and  Lateral  Translation.  The  precise  refueling  contact  point  can  be  achieved 
without  conventional  pitch  or  roll  inputs. 

2.6.2. 3 Precision  Approach  - An  ILS  approach  assumes  an  airborne  unit  to  determine 
aircraft  deviation  from  a precision  approach  path  and  four  ground  station  elements. 

These  are  the  localizer,  glide  slope,  marker  beacons  and  approach  lights.  In  cur- 
rent aircraft,  the  localizer  signal  is  applied  to  the  HSI  course  deviation  bar,  ADI 
localizer  indicator,  and  the  HUD  integrated  flight  director.  The  glide  slope  signal 
is  displayed  on  the  ADI  glide  slope  indicator  and  the  HUD  integrated  flight  director. 

The  system  receives  signals  from  the  marker  beacon  and  illuminates  the  Beacon  light 
and  a comparable  symbol  on  the  HUD.  The  current  approach  procedure  requires  the 
pilot  to  select  the  proper  localizer  frequency  and  aurally  verify  the  localizer 
identifier.  He  must  set  the  published  inbound  ILS  runway  heading  (course)  in  the 
COURSE  window  of  the  HSI.  He  must  cross  check  the  Instrument  Approach  Plate  profile 
view  for  published  minimums. 

When  established  inbound  on  the  localizer,  he  must  setup  approach  configuration 
and  maintain  level  flight  until  interception  of  the  glide  slope  is  indicated.  The 
speed  brake  must  then  be  extended  and  pitch  and  power  adjusted  as  required.  When 
the  Beacon  Lamp  illuminates  and  the  "BKN"  symbol  appears  on  the  HUD  indicating 
station  passage,  the  controlling  agency  must  be  notified.  The  pilot  then  flies  the 
on-course  steering  commands  to  the  published  decision  height.  One  common  difficulty 
confronting  the  pilot  of  a conventional  aircraft  while  executing  an  ILS  approach 
is  maintaining  proper  course  and  position  on  the  glide  slope  during  descent. 

The  DFCS  provides  improved  aircraft  stability  and  requires  less  control 
activity  for  the  pilot.  Transition  from  level  flight  to  the  glide  slope  is  simpli- 
fied. When  the  pilot  reduces  power,  the  DFCS  maintains  the  aircraft  attitude,  a 
negative  flight  path  angle  is  established  and  the  angle-of-attack  is  increased. 

Aircraft  attitude  changes,  which  typically  occur  with  power  changes  and  equipment 
extension;  e.g.,  landing  gear  and  speed  brakes,  are  minimized.  When  the  glide  slope 
is  captured  and  the  required  AOA  established,  tracking  the  course  steering  commands 
is  enhanced.  For  manual  approaches,  adjustments  in  altitude  and  azimuth  can  be 
made  using  Direct  Lift  or  Lateral  Translation  as  necessary.  Pitch  and  roll  inputs 
are  eliminated  except  where  gross  corrections  may  be  required.  The  DFCS  flight 
management  concept  eliminates  the  pilot's  task  of  selecting  ILS  frequencies,  setting 
the  inbound  ILS  runway  heading  (course)  in  the  course  window  of  the  HSI,  and  cross 
checking  the  published  let-down  plate.  Proper  display  presentation  is  accomplished 
through  pre-flight  programming  of  the  computer  which  assures  automatic  presentation 
of  approach  flight  data.  In  the  Auto  ILS  and  Auto  Throttle  flight  control  modes,  the 
aircraft  is  coupled  with  the  ILS  and  is  automatically  controlled  throughout  the 
approach.  The  pilot  needs  only  assume  control  at  decision  height  and  land  the  aircraft. 
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2.6. 2. 4 Crosswind  Landing  - In  a conventional  aircraft,  crosswinds  are  compensated 
for  by  using  the  wing-low  method,  crabbing,  or  a combination  of  both.  If  the  crab 
method  is  selected,  the  aircraft  heading  is  aligned  with  the  runway  just  prior  to 
touchdown.  The  wing-low  method,  depending  on  the  mechanization  of  the  flight  con- 
trol system,  will  likely  require  overpowering  the  aileron  rudder  interconnect  (ARI) 
with  the  rudder  or  disengaging  the  ARI  by  pulling  the  circuit  breaker.  The  DFCS 
eliminates  the  requirement  for  employing  either  of  these  techniques.  Once  proper 
runway  alignment  has  been  achieved,  a normal  descent  and  touchdown  can  be  made  using 
only  Lateral  Translation  (direct  side  force)  as  necessary  to  compensate  for  the 
crosswind.  The  problems  inherent  with  aircraft  slip  or  crab  during  the  approach  are 
eliminated.  An  illustration  depicting  a crosswind  landing  with  and  without  Lateral 
Translation  capability  is  presented  in  Figure  24. 


Conventional  Aircraft 


DFCS  Aircraft 


^]Wind 


CRAB  or  SLIP  Required 
to  Correct  for  Wind  Drift 


Direct  Side  Force 
Compensates  for  Wind  Drift 


Pilot  Comments: 

e Very  Effective  for  Aligning  Aircraft  Longitudinal  Axis  with  Runway  Heading  and 
Eliminating  Aircraft  Drift 

Figure  24 

Effect  of  Lateral  Translation  Capability 
Landing  Segment 

2. 6. 2. 5 Navigation  - Current  fighter  aircraft  navigation  capabilities  generally 
include  ILS,  TACAN,  and  an  Inertial  Navigation  System  (INS).  The  ILS  has  been  dis- 
cussed previously  under  "Precision  Approach".  Current  TACAN  procedures  require  the 
pilot  to  sequentially  select  the  individual  TACAN  frequencies,  aurally  verify  the 
station  identifier,  select  the  desired  radial,  and  fly  the  flight  plan  (normally 
displayed  on  the  pilot's  kneeboard)  from  data  displayed  (bearing  and  distance,  bank 
command,  and  course  deviation)  on  the  HUD,  ADI  and  HSI.  The  aircraft  is  flown 
manually,  however,  auto  flight  control  features  such  as  attitude  hold  and  altitude 
hold  may  be  used  on  individual  course  legs.  The  INS  is  a fully  automatic  three  dimen- 
sional navigation  system,  which  provides  the  primary  attitude  reference,  and  displays 
a continuous  present  position  in  latitude  and  longitude.  Data  for  destinations, 
air-to-ground  targets,  or  aircraft  present  position  can  be  inserted  in  the 
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navigation  control  indicator.  The  pilot,  having  selected  and  inserted  a destination 
and  the  NAV  Steer  Mode,  receives  steering  data  from  the  HUD,  ADI  and  HSI  to  the 
destination  selected.  Upon  reaching  the  destination,  he  must  manually  select  the 
next  destination.  Navigation  information  will  again  be  furnished  to  the  pilot 
through  the  aforementioned  displays.  Again,  the  aircraft  is  flown  manually;  however, 
auto  flight  control  features  (attitude  and  altitude  hold)  may  be  used  during  the 
flight.  , 

The  DFCS  flight  management  implementation  provides  for  position  fixing,  flight 
plan  management,  steering  computations,  point-to-point  navigation,  airport  proce- 
dures and  other  informtion  such  as  electronic  warfare  data  required  to  support 
tactical  fighter  operations.  It  also  provides  a fully  automatic  three  dimensional 
area  navigation  system  capable  of  flying  directly  between  any  two  points  as  well  as 
on  airways,  SID's,  STAR’s,  and  RNAV  routes.  The  flight  management  computer,  rather 
than  the  pilot,  performs  sensor  management,  such  as  frequency  selections  and  initial- 
ization. The  DFCS  flight  management  implementation  provides  for  external  loading  of 
the  flight  plan  which  can  then  be  called  up  on  appropriate  displays.  The  point  of 
origin  and  destination  and  all  intervening  waypoints,  complete  with  specified  alti- 
tudes, are  displayed  on  the  CDC.  Course  lines  for  each  leg  are  displayed  on  a 
Multi-Functional  Display  (MFD  II).  Having  constructed  the  flight  plan,  the  pilot, 
after  takeoff,  can  engage  the  Auto  Lat  Nav  and  Auto  Vert  Nav  flight  control  modes, 
which  automatically  fly  the  lateral  and  vertical  profile  of  the  designated  flight 
plan.  Other  options,  such  as  offset  course  guidance  of  up  to  +40  miles,  and  automat- 
ically executed  holding  patterns,  are  also  available  and  can  be  integrated  with  the 
regular  flight  plan.  These  capabilities  greatly  reduce  the  navigation  workload  of 
the  pilot,  such  as  selecting  pertinent  TACAN  frequencies;  and  resolves  most  of  the 
mental  calculations,  such  as  time  and  distance  to  next  waypoint,  normally  required 
for  the  accomplishment  of  the  total  mission. 

When  flying  the  flight  management  system  manually,  the  CDC  and  Map  Display  are 
operated  in  the  same  manner  and  present  the  same  data  as  previously  discussed. 

2. 6. 2.6  Air-to-Ground  Gunnery  and  Bombing  - The  key  to  a successful  air-to-ground 
delivery  is  the  pilot's  ability  to  fly  his  aircraft  to  meet  a set  of  predetermined 
release  conditions,  e.g.,  airspeed,  altitude,  and  dive  angle.  Current  procedures 
require  the  pilot  to  select  the  proper  reticle  depression  angle,  visually  acquire 
the  target,  and  maneuver  the  aircraft  to  approach  the  run-in  heading  from  a 90° 
position.  After  establishing  the  airspeed,  he  must  roll  into  the  target  allowing 
for  a crosswitd  and  lower  the  aircraft  nose  below  the  horizon  after  30°  into  the 
turn.  Roll-out  should  be  made  so  that  the  dive  angle  is  slightly  steeper  than 
necessary  to  ensure  the  reticle  is  below  the  target.  Cross-check  of  the  displays 
must  be  accomplished  while  maintaining  track  and  airspeed.  Release  or  firing  may 
be  initiated  when  slant  range,  dive  angle,  airspeed,  and  sight  reticle  on  the  target 
are  simultaneously  achieved.  Rapid,  accurate  solution  of  the  target  tracking  problem 
is  the  primary  task  of  the  fighter  pilot  in  the  air-to-ground  flight  environment. 

The  pilot  also  has  the  option  to  fly  the  AUTO  mode,  which  is  a fully  computed  auto- 
matic weapon  release  mode.  The  aircraft  is  flown  to  position  the  reticle  on  the 
target.  The  designator  controller  is  depressed  designating  the  target  and  auto- 
matically switching  to  the  AUTO  mode.  The  target  designator  box,  azimuth  and 
elevation  steering  lines,  time-to-go,  and  the  velocity  vector  are  displayed  as 
primary  symbols  in  this  mode.  The  target  designator  box  remains  positioned  on  the 
target,  and  any  designation  error  may  be  corrected  by  repositioning  the  designator. 
The  major  task  in  this  mode  is  nulling  the  azimuth  steering  error  by  flying  the 
velocity  vector  to  coincide  with  the  azimuth  steering  line. 
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The  pilot,  flying  the  DFCS,  needs  only  to  align  the  aircraft  with  the  approxi- 
mate tareet  position,  and  then  accomplish  precise  alignment  and  target  tracking 
through  Flat  Turning,  Lateral  Translation,  and  Direct  Lift.  The  Flat  Turn  capa- 
bility is  available  to  the  pilot  through  the  rudder  pedals  and  Lateral  Translation 
and  Direct  Lift  through  the  controller  on  the  side  stick.  The  normal  DFCS  technique 
after  roll-in  on  the  target  is  to  solve  azimuth  displacement  using  the  Flat  Turn 
capability  and  eliminate  wind  drift  with  Lateral  Translation.  Illustrations  depict- 
ing use  of  the  Flat  Turn  and  Lateral  Translation  capabilities  in  air-to-ground 
mission  segments  are  shown  in  Figures  25  and  26  respectively.  Vertical  corrections 
would  be  accomplished  with  Direct  Lift  or  pitch  inputs.  This  technique  eliminates 
the  need  for  conventional  rolling  of  the  aircraft  with  its  resultant  pendulum  effects. 
However,  when  larger  corrections  are  required,  the  DFCS  aircraft  can  be  rolled  abou 
any  selected  aircraft  axis,  e.g.,  the  reticle  depression  angle,  which  effectively 
eliminates  the  pendulum  effect. 


Without  Flat  Turn 


With  Flat  Turn 


~v 


p.  Target 


Heading  Correction  Requires  Repeated 
Right  and  Left  Lateral  Stick  Inputs 


Heading  Correction  Requires  Only 
Rudder  Pedal  Input  in  the  Direction 
of  the  Turn 


Pilot  Comments: 

• Very  Effective  for  Small  Heading  Corrections  in  Air-to-Ground  Segments. 

• The  Use  of  Rudder  Pedals  Provided  a Natural  Means  for  Flat  Turn  Control. 

Figure  25 

Effect  of  Flat  Turn  Capability  . 

I 

2.6.2. 7 Air-to-Air  Combat  - Air  combat  involves  the  use  of  maneuvers  which  are 
divided  into  offensive  and  defensive  categories.  Basic  offensive  maneuvers  include 
the  high  and  low  yo-yo,  lag  pursuit,  lag  roll  and  barrel  roll  attacks.  The  number 
of  basic  defensive  maneuvers  is  somewhat  greater  and  includes  the  split,  break, 
hard  turn,  roll  away,  high-g  barrel  roll,  spiral,  flat  and  rolling  scissors,  and 
vertical  reversal.  This  inventory  of  maneuvers  is  used  by  the  fighter  pilot  in  the 
combat  environment  to  complete  a successful  attack  on  an  enemy  aircraft  or  to 
extract  himself  from  a defensive  situation  with  the  enemy  to  his  rear.  How  well  he 
accomplishes  the  specific  task  at  hand  is  directly  related  to  his  proficiency  as  a 
pilot  and  the  flight  characteristics  of  his  particular  aircraft. 
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Without  Lateral  Translation 


With  Lateral  Translation 
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Note:  The  illustrations  neglect  ballistic  drag  effects 
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Aircraft  Heading  and 
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Pilot  Comments: 

• Very  Effective  for  Aligning  the  Aircraft  Longitudinal  Axis  with  the 
Ground  Track  in  Steady  Crosswinds 

• A Displacement  Type  Controller  is  Preferred  in  Lieu  of  a Force 
Controller  for  Lateral  Translation 

Figure  26 

Effect  of  Lateral  Translation  Capability 
Bombing  Segment 

The  aircraft  control  responses  for  the  DFCS  have  been  tailored  to  the  require- 
ments of  the  air  combat  situation.  Increased  acceleration,  turn  rate,  and  climb 
capability  have  been  achieved  through  the  installation  of  horizontal  canards  and 
wing  slats  which  have  reduced  maneuvering  drag,  and  increased  lift.  This  effectively 
produces  a better  energy  level  for  maneuvering  flight.  At  high  angles-of-attack, 
buffet  is  greatly  reduced,  and  wing  rock  is  virtually  eliminated.  The  "g"  capability 
of  the  aircraft  is  increased  at  supersonic  speeds.  The  integration  of  a Departure 
Preventer  allows  the  pilot  to  concentrate  fully  on  the  aircraft  against  which  he  is 
liianeuvering  and  minimizes  the  requirement  to  monitor  continually  the  airspeed,  angle- 
of-attack  and  g-indicator.  These  increased  capabilities  allow  the  pilot  to  exploit 
the  advantages  derived  from  the  typical  air  combat  maneuvers. 

Lateral  and  Vertical  Fuselage  Aiming  will  be  possible  in  the  DFCS  through  the 
use  of  the  rudder  pedals  and  the  direct  lift  controller  in  the  Air  Combat  Mode. 

This  capability  will  allow  the  pilot  to  rotate  the  aircraft  fuselage,  which  changes 
the  aircraft  pitch  attitude  and  heading,  but  maintains  the  direction  of  the  existing 
velocity  vector.  The  technique  allows  the  pilot  to  align  his  aircraft  gun  with  the 
target  without  changing  the  aircraft  flight  path.  Fuselage  Aiming  can  effect  a gun 
solution  not  normally  attainable  from  certain  flight  situations.  An  illustration 
depicting  the  use  of  fuselage  aiming  in  air-to-air  combat  is  presented  in  Figure  27 . 

2. 6. 2. 8 Conclusion  - An  evaluation  of  pilot  procedures  and  tactics,  in  terms  of  the 
unique  flight  qualities  of  the  DFCS  aircraft  and  its  integrated  flight  management 
system,  indicates  a definite  increase  in  weapon  system  capability.  The  high  degree 
of  flight  automation  and  display  integration  simplified  pilot  tasks  and  enhances  his 
ability  to  perform  specific  procedures  and  tactics.  These  increased  capabilities 
should  provide  improved  weapon  delivery  effectiveness  without  increased  workload. 


and  Rudder  Pedals 


Pilot  Comments: 

• Fuselage  Aiming  Should  be  Provided  for  Air-to-Air  Combat 

Figure  27 
Fuselage  Aiming 


, A i nFPS  FMERGENCY  PROCEDURES  - An  evaluation  was  conducted  to  determine  the 
necessity^for^developing  emeT^cy  procedures  with  the  current  DECS  design  concepts. 
The  following  rationale  has  been  established: 

, i Flisht  Control  - The  flight  control  system  will  be  designed  to  automatically 

gu" fSS.s  occur.  ^Therefore,  little  or  no  o.orgoncy  pilot  procedure. 
SS  be  required  for  flight  control  for  first  failures.  to  exaupl.  of  «hat  night  be 
done  after  multiple  failures  is  shown  in  Figure  28. 

, , nunlavc  and  Controllers  - Essential  flight  data  are  presented  redundantly 

’r^inirSLl  It  is  also  planned  that  the  essential  flight  parameters  will 
on  the  HUD  and  **  “ MFD  I This  will  provide  for  continuous  flight  data  in 

Se  Senf  of  eSh£Xl£ ” computer  failure.  The  CDC  and  flight  management  com- 
desirable. 

? fi  T 1 Electrical  Power  - It  is  planned  that  battery  electrical  power  will  be 
^Ued  to  both  tte  fight  oonrrol  ay.ta.  »d  di.pl.ys  in  the  -e«of  aircraft 
failure  This  will  provide  for  continued  operation  for  some  speciriea 
553*5  timeSnd  removes  the’need  for  a specific  emergency  procedure.  Failure 
annunciation,  however  may  be  desirable. 

9 6 T.4  Conclusion  - The  evaluation  indicated  that  few  emergency  procedures  need 
be  developed  for  the  current  DFCS  design  concepts. 


I't't  DEDICATED  VERSUS  TIME-SHARED  DISPLAYS  AND  CONTROLLERS  - Each  mission  function 
a analyzed  to  determine  its  information  requirements.  Tislc  identification  was 
accomplished  by  further  subdivision  of  each  function.  The  results  of  these  studies 
were  used  to  establish  the  displays  information  and  controller  capabilities  needed 
to  support  each  of  the  mission  functions. 


The  display  inrormation  was  subsequently  assigned  to  specific  displays,  i.e. , 
HUD,  MFD  I,  MFD  II,  and/or  CDC.  These  assignments  resulted  in  the  identification* 
of  opportunities  for  time-sharing  of  information  on  each  of  the  displays.  An 
example  of  the  time-sharing  of  display  information  is  presented  in  Table  4 by  the 
changes  of  display  information  for  the  functions  of  the  radar  missile  attack  segment 


Table  4 

Example  of  Time-Sharing  of  Display  Information 


Segment 

Function 

HUD 

MFD-  I 

MFD-  I Alternate 

MFD  n 

Radar 

Missile 

Attack 

Navigate 
to  Target 

Flight  Director 

Airspeed 

Altitude 

Attitude 

Heading 

Velocity  Vector 
Mach 

Flight  Control  Mode 
Side  Slip  Angle 
Lateral  Acceleration 
Gun  Cross 

Radar  Display  (A/ A) 

Airspeed 

Altitude 

Attitude 

GS  and  TAS 

Mach 

Flight  Control  Mode 
Antenna  Azimuth  Scale 
and  Marker 

Antenna  Elevation  Scale 
and  Marker 
Radar  Range  Scale 
Radar  Grid  Lines 
Target  Display 
Target  Designator 

Flight  Director 

Aircraft  Reference 

Airspeed 

Altitude 

Attitude 

Heading 

Mach 

Flight  Control  Mode 
Side  Slip  Angle 
Lateral  Acceleration 

Aircraft  Symbol 
Flight  Plan 
Waypoints 
Range  (80  NM) 
Heading 
Lubber  Line 
Tactical  Data 
(SAM,  AAA,  and  AA 
Threat  Data) 

Range  Marks 

Select  Pilot 
Assist  Mode 
(A/A  Combat 
MRM) 

Same  as  Above 
+ Weapon  Type  and 
Quantity 
+ G Readout 
-Flight  Director 

Same  as  Above 
+ G Raadout 

Same  as  Above 

Same  as  Above 

Detect  and 
Identify  Target 

Same  as  Above 

Same  as  Above 
+ Radar  Target 
+ IFF  Target  Data 
- IFF  Target  Data 

Same  as  Above 

Same  as  Above 

Perform 

Radar 

Lock-Dn 

Same  as  Above 
+ ASE 

+ Target  Range 
+ Launch  Limits 
+ Steering  Dot 
+ Radar  Range  Rate 
+ Target  Designator 
Box 

+ Missile  FOV 

Same  as  Above 
+ ASE 

+ Target  Range 
+ Target  Altitude  Delta 
+ Steering  Dot 
+ Radar  Range  Rate 
+ Launch  Limits 
- Target  Designator 

Same  as  Above 

Same  as  Above 

The  controller  capabilities  needed  to  support  each  of  the  mission  functions 
were  assigned  to  the  specific  controllers,  i.e.,  side-stick,  throttles,  and  CDC. 
These  assignments,  which  were  accomplished  using  MIL-STD-203E  as  a guide,  resulted 
in  the  identification  of  opportunities  for  time-sharing  of  the  capabilities  on  each 
of  the  controllers.  Three  controller  mounted  switches,  where  time  sharing  was 
utilized  are  as  follows: 
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o Gunsight  Stiffen  or  Missile  Reject  Switch  (Throttle)  - Changes  function 
to  match  selected  flight  control  mode. 

o Auto  Acquisition  Switch  or  Inflight  Refueling  Probe  Disengage  (Throttle)  - 
Changes  function  to  match  radar  power  switch  position,  i.e.,  refuel  probe 
disengage  when  radar  is  in  OFF  or  STBY  and  auto  acquisition  with  radar  in 
operation. 

o Nose  Gear  Steering  or  SRM  Uncage  (Side  Stick  Controller)  - Change 
function  according  to  weight  on  wheels  switch  open  or  closed. 


In  addition,  the  keys  of  the  computer  and  display  controller  are  time  shared 
as  discused  in  Reference  (15) . 

Conclusions 


Military  pilots  evaluated  the  time-sharing  aspects  of  the  DFCS  cockpit  arrange- 
ment during  the  static  Displays  and  Controllers  Evaluations  and  the  dynamic  Inte- 
grated Control  Law  and  Display  Simulation.  Results  of  these  evaluations  are 
presented  in  Section  3.0.  Time-sharing  concepts  were  readily  accepted  by  the  pilots 
and  they  expressed  the  opinion  that  these  time-sharing  innovations  of  displays  and 
controllers  would  reduce  workload  and  enhance  weapon  system  management . 


Reference:  15.  Digital  FCS  Study  Final  Report,  523-0766085-00111M,  Collins 

Avionics  Division,  Rockwell  Internationl,  Cedar  Rapids,  Iowa. 
15  February  1975 
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2.7  DISPLAYS  AND  CONTROLLERS  DEVELOPMENT 


2.7.1  INTRODUCTION  - Display  and  controller  analyses  were  performed  to  help  develop 
and  evaluate  crew-system  concepts  for  displays  and  controllers.  The  results  of  the 
analyses  were  used  to  help  design  the  configurations  for  the  design  aid  and  simula- 
tion. The  following  objectives  were  considered  in  the  analyses  and  design: 

o Enhancing  the  operation  of  the  Digital  FCS , 

o Permitting  the  pilot  to  behave  as  a mission-oriented  manager  rather  than  a 
subsystem  operator, 

o Utilizing  the  pilot's  decision-making  capability  within  acceptable  workload 
levels,  and 

o Accomplishing  all  of  the  above  without  increasing  pilot  workload. 

The  results  from  the  Pilot  Interface  Analysis  (Section  2.6)  along  with  the 
knowledge  gained  through  the  review  of  related,  previously  accomplished,  programs 
such  as  the  IIPACS  program.  References  (16),  (17),  (18),  and  (19),  the  HAC  program, 
Reference  (19) , and  the  AIMIS  program  were  utilized  to  develop  initial  crew-system 
concepts  discussed  in  Section  2.7.2. 

These  crew-system  concepts  combined  with  the  results  from  the  Mission  Scenario 
Analysis;  Air  Force,  Navy  and  MCAIR  Displays  and  Controllers  Coordination  Meetings; 
drawing  layouts;  and  three  dimensional  design  aids  were  used  to  establish  the  candi- 
date display  and  controller  arrangements. 

Displays  analyses  and  controllers  analyses  are  discussed  in  Sections  2.7.3 
and  2.7.4,  respectively. 


References:  16.  Zipoy,  D.R. , and  Premselaar,  S. J.  , "Advanced  Integrated  Fighter 

Cockpit  Study,"  Technical  Report  AFFDL-TR-71-57 . Wright- 
Patterson  AFB,  Ohio.  June  1971. 

17.  Zipoy,  D.R. , et  al,  "Integrated  Information  Presentation  and 

Control  System  Study,  Volume  I System  Development  Concepts"  Tech- 
nical Report  AFFDL-TR-70-79.  Wright-Pat ter son  AFB,  Ohio. 

August  1970. 


18.  Zipoy,  D.R. , et  al,  "Integrated  Information  Presentation  and 
Control  System  Study,  Volume  II,  System  Analysis,"  Technical 
Report  AFFDL-TR-70-79.  Wright-Patterson  AFB,  Ohio.  August  1970. 

19.  Premselaar,  S.J.,  et  al,  "Integrated  Information  Presentation  and 
Control  System  Study,  Volume  III  Degraded  Mode  Analysis,"  Tech- 
nical Report  AFFDL-TR-70-79.  Wright-Patterson  AFB,  Ohio. 

June  1971. 


20.  Sinnett,  J.M.,  Asiala,  C.F.,  "Advanced  Fighter  Concepts  Incorporat- 
ing High  Acceleration  Cockpits;  Volume  IV-Pilot  Performance 
Analyses,"  Technical  Report  AMRL-TR-72-116 . Wright-Patterson  AFB, 
Ohio.  July  1973. 


51 


2.7.2  CREW-SYSTEM  CONCEPTS  - Analysis  and  design  were  performed  to  establish  crew- 
system  concepts  for  the  Digital  PCS  cockpit  geometry,  lighting  and  lighting  control, 
and  locations  of  proposed  controllers  and  displays.  Cockpit  designs  prepared  for 
use  in  engineering  evaluations,  workload  analyses,  and  the  design  aid  and  simulator 
construction  were  modified  and  refined  as  the  Digital  FCS  Study  progressed.  These 
designs  were  used  in  part  to  formulate  the  recommended  ADP  configuration. 

The  cockpit  geometry  for  the  Digital  FCS  design  was  based  on  the  overall  dimen- 
sions of  the  designated  F-4  test  aircraft.  The  seat,  console  location,  canopy  sill 
height,  windshield  bow,  and  fuselage  structure  in  the  cockpit  are  representative  of 
a typical  F-4.  However,  consoles,  instrument  panels,  displays,  and  controllers  have 
been  located  to  provide  the  most  acceptable  access  and  ease  of  operation.  The  over- 
all arrangement  was  designed  to  be  generally  compatible  with  the  High  Acceleration 
Cockpit  (HAC)  concept,  Reference  (20) . 

Lighting  and  lighting  control  for  advanced  electronic  displays  is  recognized  as 
a critical  area  for  design  consideration.  The  Digital  FCS  display  and  controller 
concept  provides  for  manual  control  of  cockpit  and  specific  component  lighting.  In 
addition,  electronic  displays  such  as  the  HUD  and  MFD' s are  provided  with  individual 
manual  and  automatic  display  intensity  controls  to  compensate  for  varying  ambient 
light  conditions.  Lighting  and  lighting  control  concepts  are  not,  however,  subject 
to  practical  analysis  and  verification  by  static  design  aids  and  simulation  of  the 
type  done  as  a part  of  the  Digital  FCS  Study. 

Initially,  designs  were  prepared  to  determine  candidate  display  and  controller 
arrangement,  location,  and  configuration.  Numerous  arrangements  were  defined  in 
sketch  form.  These  arrangements  were  subjectively  evaluated  by  MCAIR  design  engi- 
neering, human  engineering,  and  pilot  personnel.  Critiques  and  suggestions  were 
made  by  the  Air  Force  and  Navy  project  office  personnel  during  various  coordination 
meetings.  Several  of  these  arrangements  were  then  refined  by  more  detailed  design 
work.  Air  Force  and  Navy  standards  for  human  engineering  design  criteria  and 
pilot  anthropometric  data  were  used  as  criteria  for  the  design  layouts.  The  major 
controllers,  i.e.,  the  side  stick,  rudder  pedals,  throttle,  and  Computer  and  Display 
Controller  (CDC) , were  designed  to  accommodate  the  5th  through  95th  percentile 
pilots. 

Conclusions 


Cockpit  arrangements  generally  compatible  with  the  HAC  concept  were  designed  and 
refined  for  subsequent  use  in  engineering  evaluations,  workload  analyses,  and  con- 
struction of  the  design  aid  and  simulator.  The  resulting  arrangement  was  used  in 
part  to  formulate  the  recommended  ADP  configuration. 

2-7.3  DISPLAYS  ANALYSES  - Analyses  were  conducted  to  define  advanced  cockpit 
displays  which  offer  possible  reductions  in  pilot  workload,  and  improvements  in 
weapon  system  management  over  conventional  displays. 

Early  in  the  display  development,  an  arrangement  was  established  which  formed 
a basis  for  the  specific  analysis  topics.  First, it  was  decided  that  a Head-Up 
Display  (HUD)  was  a basic  requirement.  It  was  also  decided  that  two  separate  head- 
down  CRT  displays  were  desirable  to  provide  the  pertinent  radar,  EO,  EADI,  and  EHSI 
information.  One  CRT  would  primarily  present  vertical  situation  information  and  is 
designated  Multi-Function  Display  I (MFD  I).  The  other  CRT  would  primarily  present 
horizontal  situation  information  and  is  designated  MFD  II. 
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Specific  topics  which  were  included  in 


the  analyses  are: 


o Utilization  of  advanced  Digital  FCS  control  laws  for  display  information, 
o Levels  of  display  redundancy  required  for  Digital  FCS  implementation, 
o Considerations  of  dedicated  vs  time-shared  displays, 
o Pilot-computer-display  interface, 
o Display  symbology  and  formats, 

o Considerations  of  various  mission-oriented  displays, 
o Priority  management  system  for  the  displays, 

o Considerations  of  data  processing  functions  accomplished  in  separate  symbol 
generators , 

o Considerations  of  integrating  energy  management  parameters  with  conventional 
flight  control  parameters, 

o Computer-generated  advisory  information  in  discrete  data  and  numeric  form, 

o Advisories  for  preflight  and  in-flight  failure  information,  and 

o Annunciator  displays  to  provide  advisory  status  and  readout  of  selected 
Digital  FCS  functions. 

2‘ 7,3,1  Utilization  of  Advanced  Control  Laws  for  Display  Information  - Analysis  and 
simulation  results  indicate  that  the  display  information  should  be  mission  oriented, 
i ‘ e ■ , °nly  the  information  required  for  a mission  segment  should  be  presented  while 
that  segment  is  being  flown.  Since  the  multimode  control  laws  are  also  mission 
oriented,  it  may  be  said  that  the  displays  are  directly  related  to  the  control  laws. 
However,  with  the  following  exceptions,  little  display  information  can  be  derived 
directly  from  the  control  law  computations: 

o Energy  management  desired  profiles  in  the  Mach  and  altitude  plane, 

o Pitch  and  roll  steering  commands  for  auto  navigation,  ILS,  ACL  and  energy 
management , and 

o Alpha-numeric  indicating  flight  control  mode  selected. 


The  control  law  computations  were  utilized  to  derive  information  for  the  above 
parameters  during  the  Integrated  Control  Law  and  Display  Simulation. 

2- 7,3,2  Lg-v-eAs  of  Display  Redundancy  Required  - Display  redundancy  has  been 
discussed  as  part  of  other  related  studies.  Essential  flight  data  can  be  and  have 
been  presented  redundantly  on  the  HUD  and  MFD  I as  a part  of  the  weapon  delivery 
and  sensor  displays.  The  MFD  I display  format  incorporates  airspeed,  altitude  and 
aircraft  attitude  with  or  without  the  Radar,  Electro-Optical,  or  Infra-Red  sensor 
displays.  Heading  information  is  displayed  redundantly  on  the  HUD  and  MFD  II  and 
is  incorporated  in  the  MFD  I flight  information  display  format.  It  also  is  planned 
that  essential  flight  data  will  be  hard  wired  to  the  HUD  and  MFD  I.  This  redundancy 
will  provide  continuous  flight  data  in  the  event  of  failure  of  either  a display  or  a 
flight  management  computer.  Back-up  electrical  power  will  be  supplied  to  the  dis- 
plays, as  well  as  the  FCS,  in  the  event  of  failure  of  normal  electrical  power.  The 
redundant  display  of  essential  flight  data  has  been  demonstrated  by  the  Integrated 
Control  Law  and  Display  Simulation. 
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2. 7. 3. 3 Considerations  of  Dedicated  Versus  Time-Shared  Displays  - The  analysis  of 
dedicated  versus  time-shared  displays  is  discussed  under  Section  2.6.4. 

2. 7. 3. 4 Pilot-Computer-Display  Interface  - Analysis  and  simulation  indicate  that 
simplified  pilot  access  to  displays,  simultaneously  with  flight  control  mode  selec- 
tion through  switches  on  the  primary  controllers  and/or  the  CDC,  is  effective  in 
reducing  pilot  workload  as  shown  in  Section  2.20.  Also,  the  option  for  selection 

of  display  presentations  independent  of  the  flight  control  mode  selected  is  desirable. 

2. 7.3.5  Display  Symbology  and  Formats  - Analyses  were  performed  to  define  symbology 
and  formats  to  be  used  in  the  flight  control  mode  related  displays  which  enhance  the 
operation  of  the  Digital  FCS.  The  symbology  developed  is  designed  to  present  clear 
and  concise  flight,  attack,  take-off  and  landing  information  to  the  pilot.  The 
display's  information  content  and  ease  of  comprehension  were  designed  to  reduce 
pilot  workload  and  improve  mission  effectiveness  as  defined  in  Section  2.3. 

Initially,  a search  was  made  of  various  specifications  and  reports  concerning 
electronic  displays.  The  information  acquired  was  combined  to  form  baseline  sym- 
bology and  formats.  Additional  display  symbology  and  formats  were  provided  by  the 
Air  Force  and  Navy  Program  Office.  Several  examples  of  symbols  and  formats  were 
assembled  into  a package  of  "Paired  Comparisons"  and  "Information  Requirements 
Questionnaire".  The  package  was  then  evaluated  by  Air  Force  and  Navy  test  pilots 
to  obtain  their  preference  of  specific  symbols  and  formats  to  be  displayed  during 
various  flight  segments.  The  results  of  the  evaluation  were  assembled  and  reviewed 
by  Air  Force,  Navy  and  MCAIR  representatives  during  a coordination  meeting.  This 
review  resulted  in  agreement  on  the  initial  set  of  symbology  and  formats  to  be 
evaluated  during  dynamic  simulations. 

During  the  Integrated  Control  Law  and  Display  Simulation  evaluation,  pilots 
made  additional  recommendations  for  symbology  and  format  changes;  see  Section  3.3.3. 

2. 7. 3.6  Consideration  of  Various  Mission  Oriented  Displays  - Analysis  indicates 
that  generally,  only  the  display  information  required  for  a mission  segment  should 
be  presented  while  that  segment  is  being  flown.  Therefore,  appropriate  formats 
were  developed  with  the  required  information  to  provide  presentations  which  are 
simultaneously  displayed  when  a flight  control  mode  is  selected  and  automatically 
displayed  when  other  discrete  events  occur,  e.g. , landing  gear  position  change, 
radar  status  change  or  faults.  The  preceding  philosphy  was  confirmed  by  the 
simulations;  see  Section  3.3.3. 

2. 7. 3. 7 Priority  Management  System  for  the  Displays  - A priority  management  system 
for  display  content  and  format  was  developed  which  provides  a display  presentation 
appropriate  to  the  flight  control  mode  selected  and  a discrete  event,  e.g.,  gear 
down,  weapon  status,  range  of  a target.  During  the  simulation,  radar  presentations 
were  designated  as  first  priority  information  for  the  MFD  I.  Subsequent  pilot 
evaluations  indicated  that  when  the  normal  flight  control  mode  is  selected,  they 
preferred  the  MFD  I priority  presentation  to  be  the  EADI.  The  system  also  provided 
for  the  automatic  display  of  an  appropriate  format  and/or  high  priority  advisory 
information  when  pertinent,  e.g.,  control  system  faults  or  a tactical  threat. 
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2 . 7 . 3 . 8 Considerations  of  Data  Processing  Functions  Accomplished  in  Separate 
Symbol  Generators  - Display  data  processing  functions,  normally  included  in  symbol 
generators,  are  as  follows: 

o Input/Output  circuitry  for  interface  with  the  display  computer  and/or 
direct  interface  with  external  sensors, 

o Data  memory  which  consists  of  random  access  memory  for  buffered  storage 
of  input  data, 

o Central  Processor  Unit  (CPU)  which  controls  data  and  program  addressing, 
sequencing,  and  processing  for  input  to  the  waveform  generator, 

o Program  memory,  usually  PROM  or  ROM,  which  contains  the  entire  symbol 
calculation  instruction  set,  and 

o Waveform  generator,  which  contains  an  alphanumeric  generator,  and  a line 
and  circle  generator.  The  waveform  generator  converts  digital  data  from 
the  CPU  into  analog  waveforms  with  blanking  pulses  for  presentation  on 
the  display  units. 

Traditionally,  these  functions  have  been  included  in  a single,  dedicated  symbol 
generator  for  each  display  unit;  however,  since  the  functions  are  basically  identical, 
it  is  reasonable  to  consider  time  sharing  and  relocating  some  of  these  functions 
such  that  a single  symbol  generator  can  be  used  to  drive  two  display  units. 

With  minimum  symbol  requirements,  it  is  feasible  to  provide  appropriate  switching 
and  multiplexing  enabling  a single  symbol  generator  to  drive  several  displays.  This 
appears  cost-effective,  but  the  symbol  generator  then  becomes  a single  point  failure 
and  the  cost  advantages  may  be  lost  when  redundancy  is  necessary  for  reliability 
considerations.  Another  problem  is  that  several  typical  HUD  display  modes  require 
continuous  data  processing  attention  as  the  symbol  calculation  and  writing  times 
nearly  approach  the  symbol  refresh  period.  In  short,  the  HUD  uses  the  full  symbol 
generator  cycle  time  capacity  and  leaves  no  time  for  sharing  symbol  generation  time 
with  other  displays.  The  problem  results  primarily  from  the  fact  that  HUDs  are 
restricted  to  slow  writing  rates,  e.g.,  3000  IPS,  in  order  to  achieve  the  necessary 
high  luminance  output . 

One  approach  for  integrating  and  time-sharing  symbol  generation  functions  is 
to  move  the  waveform  generators  from  the  symbol  generators  into  the  display  units 
and  then  drive  the  display  units  directly  from  the  display  computer.  Analyses 
indicate  that  this  approach  tends  to  overburden  the  display  computer  both  in  terms 
of  memory  and  cycle  time  requirements  and,  as  a result,  would  compromise  the  primary 
computer  functions. 

Another  possible  alternative  is  to  include  the  waveform  generators  within  each 
display  unit,  with  all  displays  driven  by  a single  data  processor  which  is  in  turn 
driven  by  the  display  computer.  This  takes  the  load  off  the  display  computer  and 
allows  maximum  time-sharing  of  common  symbol-generation  hardware.  In  this  approach 
the  processor  initiates  a symbol  in  one  display;  while  that  waveform  generator  is 
drawing,  the  processor  initiates  the  second  display  and  so  on.  As  mentioned  above, 
the  problem  with  this  method  is  that  the  processor  becomes  a single  point  failure 
for  the  entire  display  system  and  a redundant  processor  would  most  likely  be 
required. 
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The  most  cost-effective  approach  to  symbol  generation  is  a concept  that 
includes  a dedicated  symbol  generator  for  the  time-consuming  HUD  and  a single  data 
processor  for  driving  both  MFD  I and  MFD  II,  which  include  their  own  waveform 
generators.  In  this  manner, adequate  flight  information  remains  in  the  event  of 
failure  of  either  symbol  generator. 

2 . 7 . 3 . 9 Considerations  of  Integrating  Energy  Management  Parameters  with  Conven- 
tional Flight  Control  Paramaters  - Consideration  was  given  to  integrating  energy 
management  parameters  into  the  displays  along  with  the  conventional  flight  control 
parameters.  Symbology  and  formats  were  developed  for  energy  management  presenta- 
tions to  be  displayed  on  the  HUD  and  MFD  I.  MFD  I displays  were  adapted  from  the 
Beyond-Visual-Range  Altitude-Mach  displays  described  in  Reference  (21) . EM  dis- 
plays were  generated  on  the  HUD  by  adding  altitude  and  Mach  command  indices  to  the 
altitude  and  Mach  scales. 

2.7.3.10  Computer  Generated  Advisory  Information  in  Discrete  Data  and  Numeric 
Form  - During  display  format  development  an  analysis  was  performed  to  identify 
the  aircraft  flight  parameters  and  system  advisories  which  should  be  displayed 
on  the  HUD  and  the  MFDs.  Alphanumeric  windows  are  provided  and  allocated  to 
specific  data,  e.g.,  weapon  status,  aircraft  "g",  Mach  and  waypoint  data. 

2.7.3.11  Advisories  for  Preflight  and  Inflight  Failure  Information  - Provisions 
have  been  made  to  present  failure  information  on  the  CDC  when  a failure  is  detected. 
An  example  of  such  information  is  shown  in  Figure  28.  An  appropriate  warning  will 
appear  on  the  HUD  and  MFD  I to  advise  the  pilot  to  check  the  CDC. 

2.7.3.12  Annunciator  Displays  to  Provide  Advisory  Status  and  Readout  of  Selected 
DFCS  Functions  - Flight  control  mode  advisory  is  provided  alphanumerically  on  the 
HUD  and  MFD  I,  e.g.,  NORM,  A/G.  The  CDC  provides  a number  of  other  advisory 
readouts  as  discussed  in  Paragraph  2. 7. 4. 5. 

2./. 3. 13  Conclusions  - The  major  conclusions  resulting  from  the  displays  analyses 
are: 

o Displays  would  consist  of  a HUD,  MFD  I,  and  MFD  II; 

o The  HUD  would  be  the  primary  flight  instrument  for  most  flight  situations; 

o The  CDC  would  be  used  for  simplified  pilot-to-computer  communication; 

o Essential  flight  data  would  be  hard  wired  and  presented  redundantly  on 
the  HUD  and  MFD  I ; 

o Sensor  presentations,  e.g.,  Radar  and  EO,  would  be  displayed  on  MFD  I 
or  MFD  II; 

o Backup  electrical  power  would  be  supplied; 

o Normally  only  information  required  for  a mission  segment  would  be  displayed 
while  that  segment  was  being  flown; 


Reference:  21.  Pruitt,  V.  R.,  "Energy  Management  Display  System  for  a Tactical 

Fighter,"  Technical  Report  AFFDL-TR-73-38.  Wright-Patterson  AFB, 
Ohio.  April,  1973. 
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Failure  Annunciation 


Figure  28 

Emergency  Procedures  - Flight  Control  System  Failure 


o Pertinent  high  priority  threat  and  fault  information  would  be  automatically 
displayed  when  appropriate; 

o A dedicated  symbol  generator  would  be  used  for  the  HUD  and  a single  data 
processor  for  both  MFDs;  and 

o Alphanumeric  windows  on  the  HUD  and  MFDs  would  display  certain  flight 
parameters,  flight  control  mode  advisory,  system  status,  and  failure 
advisories. 

2.7.4  CONTROLLERS  ANALYSES  - Analyses  and  design  have  been  conducted  to  define 
primary  controller  configurations  and  the  control  system  mode  selection,  annuncia- 
tion, and  fault  warning  panel  configurations.  The  analyses  and  design  included 
controllers  for: 

o Pitch,  roll,  and  yaw, 
o Direct-lift  and  direct-side  force, 
o Thrust, 

Simultaneous  selection  of  flight  control  mode  and  pertinent  displays. 


o 


o Preflight  operations, 
o Data  entry  and  displays,  and 
o Reset  or  correction. 


The  Digital  FCS  primary  controller  configuration  includes  a Side  Stick  Con- 
troller (SSC)  for  pitch  and  roll  control,  rudder  pedals  for  yaw  control,  a con- 
troller for  direct-lift  and  direct-side  force  controls  and  throttles  for  thrust 
control.  Control  system  mode  selection  is  accomplished  through  keys  on  the  CDC, 
or  by  controllers  located  on  the  stick  grip  and  throttle  grip. 


The  controller  locations  and  configuration  evolved  from  consideration  of: 


o The  FDL-MCAIR  SFCS  flight  test  program  results, 
o The  FDL-MCAIR  High  Acceleration  Cockpits  Study  results, 
o The  FDL-Boeing  IIP ACS  study  results, 

o The  results  of  this  program's  Pilot  Interface  Analyses, 
o Conceptual  engineering  models,  and 

o Full  scale  design  aids  representative  of  the  Digital  FCS  design. 


2. 7. 4.1  Side  Stick  Controller  - Pilot  control  of  pitch  and  roll  is  provided  by 
a side  stick  controller  located  on  the  right  side  of  the  pilot's  seat  in  line  with 
the  pilot's  normal  arm  position  at  his  side.  Figure  29  illustrates  the  digital 
FCS  grip  configuration  used  for  the  Control  Law  Simulation.  A multifunction 
switch  operates  refuel  disengage,  IR  weapon  uncage  and  nose  gear  steering.  During 
control  law  simulations  the  evaluating  pilots  generally  disliked  the  isometric 
switch  used  for  DLC  and  DSF.  They  stated  that  the  isometric  switch  provided  no 
pilot  cue  to  indicate  that  the  operational  limit  of  the  system  had  been  reached. 


Direct  Lift  and  Direct 
Side  Force  Control 


Weapon  Release 


Normal  Flight  Mode 


Gun  Trigger  - 


Multifunction  Switch  - 


Emergency  Disengage 


Figure  29 

Digital  FCS  Grip  Configuration 


III  i*a.  n • 1 1 y- 





a 


The  SSC  used  during  Control  Law  Simulation  was  the  same  one  used  in  the  SFCS 
and  has  its  pivot  point  located  at  the  base  of  the  grip.  This  base-pivot  SSC  had 
an  adjustable  armrest  and  an  adjustable  neutral  position.  In  addition,  its 
installation  provided  for  some  fore  and  aft  adjustment. 


During  the  Control  Law  Simulation  the  pilots  experienced  sensitiveness  in 
lateral  control  which  they  attributed  primarily  to  the  SSC.  Consequently,  the 
following  changes  were  made  to  the  SSC  prior  to  the  Integrated  Control  Law  and 
Display  Simulation: 


o Up  and  down  and  rotational  adjustment  was  added  to  the  whole  assembly. 


o The  armrest  of  the  controller  was  made  adjustable  inboard  and  outboard 
with  the  front  portion  under  the  wrist  adjustable  up  and  down, 


o The  DLC  and  DSF  isometric  switch  was  altered  to  provide  a small  amount 
of  displacement,  and 


o The  position  of  the  DLC  and  DSF  switch  was  exchanged  with  the  position 
of  the  trim  switch. 


The  weapon  release  button  was  deleted.  (The  weapon  release  button  was 
moved  to  the  throttle  grip  as  shown  in  Figure  30  to  alleviate  the  conflict 
of  requirements  for  the  thumb  to  operate  simultaneously  DLC,  DSF  and  weapons 
release.) 


Concurrently  with  the  DFCS  definition  study,  a palm-pivot  SSC  was  in  its  initial 
stages  of  development  at  MCAIR.  The  palm-pivot  SSC  was  designed  so  that  the  grip 
swivels  about  a point  located  approximately  at  its  center.  To  control  the  airplane 
the  pilot  rotates  the  grip  fore  and  aft  about  the  point  for  pitch  control  and  right 
and  left  about  the  point  for  roll  control.  At  the  conclusion  of  the  Control  Law 
Simulation, this  controller  became  available  for  testing.  Consequently,  a parallel 
effort  was  initiated  in  which  MCAIR  pilots  evaluated  the  palm-pivot  SSC  to  determine 
its  potential  use  during  the  Integrated  Control  Law  and  Display  Simulation;  the 
MCAIR  pilots  thought  it  would  be  better  than  the  base-pivot  SSC.  Consequently  the 
palm-pivot  SSC,  with  improved  adjustability,  was  used  during  the  Integrated  Control 
Law  and  Display  Simulation. 


During  the  Integrated  Control  Law  and  Display  Simulation, the  evaluation  pilots 
found  the  palm-pivot  SSC  somewhat  more  comfortable,  but  still  had  difficulty  tracking. 
On  the  last  day  of  simulation,  it  was  decided  to  try  again  the  base-pivot  SSC  to  see 
if  tracking  could  be  improved.  All  three  customer  pilots  who  evaluated  the 
base-pivot  SSC  with  the  improved  adjustability  experienced  improved  air-to-air 
tracking.  Statistical  tracking  data  was  not  recorded,  but  it  was  visibly  observed 
to  be  significantly  improved  with  the  base-pivot  SSC.  It  is  MCAIR' s opinion  that 
this  improved  tracking  resulted  primarily  from  the  relocation  of  the  SSC  and  through 
use  of  the  additional  adjustment  provided  for  the  SSC  and  its  armrest.  All  three 
pilots  during  the  final  debriefing  session  stated  their  preference  for  the  base-pivot 

SSC. 


2. 7. 4. 2 
pedals . 


Rudder  Pedals  - Pilot  control  for  yaw  is  provided  by  conventional  rudder 
Full  pedal  travel  was  approximately  2.6  inches. 


2. 7.4.3  Throttles  - Pilot  control  for  engine  thrust  is  provided  by  a throttle 
controller  located  on  the  left  side  of  the  pilot's  seat  in  line  with  the  pilot's 
normal  arm  position  at  his  side.  Figure  30  illustrates  the  Digital  FCS  throttle 
grip  configuration  used  for  evaluation  during  the  Integrated  Control  Law  and 
Display  Simulation.  The  evaluation  pilots’  comments  were,  in  general,  that  the 
switches  and  buttons  on  the  throttles  were  well  located  except  that  the  reach  to 
the  Air-to-Air  Mode  Select  Button  was  too  long. 

The  principal  feature  of  the  throttle  controller  was  its  relatively  short 
travel  which  was  less  than  one-half  that  of  an  F-4.  Another  feature  is  that  all 
of  its  outputs  are  electrical.  The  throttle  levers  are  also  electrically  driven 
to  provide  visual  and  tactile  pilot  cues,  although  this  feature  was  not  used  during 
man-in-the-loop  simulations.  A clutch  permits  overriding  the  gear  train  with  a 
force  applied  by  the  pilot.  An  adjustable  armrest  similar  to  the  one  on  the  SSC 
was  provided.  The  evaluation  pilots  felt  that  the  throttle  location  and  adjustable 
armrest  were  satisfactory.  They  felt  that  the  short  throw  throttle  was  good,  but 
actual  inflight  tight  tracking  tasks,  e.g. , aerial  refueling  and  formation  flying, 
would  be  required  for  verification. 


Figure  30 

Throttle  Grip  Controllers 


2. 7.4.4  Controller  Interrelationship  - The  controllers  analyses  included  considera- 
tion of  the  interrelationship  of  the  Digital  FCS  cohtroiIt5FS”~Wxi-[i  "Existing  aircraft 
system  controllers.  Controllers  for  Digital  FCS  were  identified  by  analyzing  all 
pilot  tasks  required  to  complete  the  mission  functions.  The  design  aid  included 
panels,  displays,  and  controllers  representative  of  a typical  advanced  single-place 
fighter  aircraft.  The  pilot  evaluations  concluded  that  the  overall  relationships— 
represented  were  satisfactory. 

2. 7. 4. 5 Computer  and  Display  Controller  (CPC)  - The  CDC  is  an  input-output  device 
which  provides  an  interface  between  the  pilot  and  the  flight  management  computer. 

The  lower  portion  contains  an  alphanumeric  keyboard  and  several  dedicated  page 
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select  keys  which  provide  for  selection  of  flight  control  modes,  display  formats, 
navigation  flight  plans  and  checklists.  The  upper  portion  contains  a CRT  display 
to  present  pre-flight  checklists,  flight  plans,  flight  progress,  and  other  data. 

The  CDC  used  in  simulation  was  originally  designed  by  the  Collins  Radio 
Company  as  a control  display  unit  for  an  area  navigation  system  used  in  transport 
type  aircraft.  With  some  modifications,  an  excellent  pilot-to-computer  communica- 
tion link  was  devised  for  use  in  a fighter  aircraft  with  multimode  control  laws  and 
mode-related  advanced  displays.  Figure  31  is  an  illustration  of  the  CDC.  A more 
complete  description  of  the  CDC  operation  is  contained  in  Reference  (15).  Following 
are  some  examples  of  CDC  operation. 


Figure  31 

Computer  and  Display  Controller 

To  select  a control  mode,  the  pilot  pushes  either  the  "MAN"  page  select  key 
for  a manual  mode  or  the  "AUTO"  page  select  key  for  an  automatic  mode.  Pushing 
the  "MAN"  key  automatically  engages  the  "NORMAL"  flight  control  mode  and  displays 
the  CDC  page  shown  in  Figure  32.  Pushing  the  "AUTO"  key  automatically  engages 
"ATTITUDE  HOLD"  and  displays  the  CDC  page  shown  in  Figure  33.  With  either  the 
manual  or  automatic  mode  CDC  page  shown,  the  mode  desired  is  engaged  by  depressing 
a line  select  key  adjacent  to  the  listed  mode.  A caret  depicted  next  to  the 
listed  mode  and  pointing  toward  the  line  select  key  means  that  the  mode  is  available 
for  selection  without  a prior  action.  To  select  the  vertical  navigation  mode  the 
Lateral  Navigation  Mode  must  be  selected  first,  then  the  caret  will  appear  adjacent 
to  NAV  VERTICAL  . To  select  the  Automatic  Heading  Mode,  the  desired  heading  must 
first  be  inserted  between  the  brackets,  then  the  caret  will  flip  over  and  point 
towards  the  line  select  key. 
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Pushing  the  Key  Labeled 
"Man"  Engages  the  “Nor- 
mal" Flight  Control 
Mode  and  Displays  the 
CDC  Page  Shown 
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"<  — " Means  the  Adjacent  Line  Key 
is  Available  for  Selection 


Figure  32 

FCS  Manual  Mode  Selection  on  CDC 


Pushing  the 
"Auto"  Key  Engages 
Attitude  Hold  ■ 
and  Displays  the 
Page  Shown 
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Figure  33 

FSC  Auto  Mode  Selection  on  CDC 
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The  simulation  results  indicated  that  a consistent  means  of  selecting  all 
flight  control  modes  should  be  utilized,  i.e.,  the  "MAN"  key  should  call  up  the 
list  of  selectable  modes  but  not  engage  the  Normal  Mode. 

Pushing  the  "FLT  PLAN"  key  displays  the  flight  plan  page  as  shown  in  Figure  34. 
Listed  on  the  page  are  all  waypoints  or  checkpoints  with  the  altitude  at  which  the 
flight  plan  prescribes  they  be  passed.  The  top  listed  waypoint  is  the  next  one  to 
be  passed.  The  course  the  pilot  has  selected  to  fly  to  the  waypoint  is  noted  above 
the  waypoint  name.  To  the  right  of  the  course  notation  is  shown  the  pilot  selected 
left  or  right  offset  from  the  original  course.  The  flight  plan  can  be  slewed  and 
waypoints  can  be  added  and/or  deleted. 


| TOC-1  | 


Block  - — -| 


DNANG 

\ - > I DEST  1 


Figure  34 

Flight  Plan  on  CDC 

Results  of  simulations  showed  that  operation  of  the  CDC  was  easy  to  learn. 

The  pilot-computer  interface  concept  demonstrated  was  readily  accepted  by  evaluation 
pilots.  Controller  functions  integrated  into  the  CDC  were  limited  by  program-scope 
to  those  directly  related  to  multimode  flight  control  and  pertinent  displays. 
However,  a number  of  other  controller  functions  are  attractive  candidates  for 
integration  and  time-sharing,  e.g..  Inertial  Nav,  Communication,  IFF,  Radar  and  EO 
Sensors.  Potential  benefits  to  be  derived  from  integration  and  time-sharing  of 
other  controller  functions  are: 

o More  efficient  use  of  panel  space, 
o Increased  pilot  efficiency,  and 
o Reduced  cost  of  ownership. 
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Conclusions  As  a result  of  the  evaluation  pilots  comments  made  during 
the  Integrated  Control  Law  and  Display  Simulation  the  following  conclusions  have 
been  made: 

o In  general,  the  location  of  the  SSC  and  throttles  in  the  cockpit  was 
satisfactory; 

o The  Air-to-Air  Mode  and  Normal  Mode  selection  through  controllers  located 
on  the  throttles  and  SSC,  respectively,  was  well  liked  because  it  permitted 
hands-on-controller  operation  during  periods  of  high  activity  or  stress; 

o The  Direct-Lift  and  Direct-Side-Force  controller  should  provide  a small 
amount  of  displacement; 

o The  base-pivot  SSC  was  easier  to  learn  and  permitted  more  effective  tracking; 

o The  SSC  mechanization,  e.g.,  grip  shape,  travels  and  breakout  forces,  needs 
improvement ; 

o The  switches  and  buttons  on  the  throttle  are  well  located,  except  that  the 
reach  to  the  Air-to-Air  Mode  select  button  was  too  long;  and 

o The  short-throw  throttle  was  satisfactory  in  simulation,  but  needs  to  be 
evaluated  in  flight. 

To  accommodate  different  size  pilots  all  side-mounted  controllers  need  pro- 
visions for: 

o Up  and  down  adjustment  with  the  seat, 

o Rotational  adjustment, 

o Inboard  and  outboard  adjustment  of  the  armrest,  and 

o Up  and  down  adjustment  of  the  armrest  under  the  wrist. 

The  CDC  was  considered  outstanding.  The  simulation  results  indicate  that: 

o The  simultaneous  selection  of  a flight  control  mode  and  its  related 
display  through  the  CDC  was  "super"; 

o The  CDC  operation  and  switchology  was  easy  to  learn; 

o The  CDC  data  update  rate  should  be  increased; 

o Selection  of  the  Normal  and  Attitude  Hold  Modes  via  the  CDC  should  be  accom- 
plished using  the  CDC  line  select  key  rather  than  being  engaged  simul- 
taneously with  the  selection  of  the  page  "MAN"  or  "AUTO";  and 

Completed  portions  of  the  flight  plan  should  remain  available  for  recall 
by  the  pilot. 
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2.8  MULTIPLEX  ANALYSTS 


i„6  to  dfcs  s?ati°n  °f  muitipi“- 

2.8.1  TRANSMISSION  NETWORK  - The  first  basic  decision  relative  to  the  structure  of 

dicltff"  Sen“rs  ov"  a sl"Sle  multiple*  transmission  line  to  each  of  the  redundant 
candidate  Networks  .^L^ld^  C!™\ellZed  arrangement,  three 

Channel  and  are  presented  Flgire^SS  36  a^d'S"86"'  “ tyPlCal  D1<ital  FCS 


Displays 
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SIU 

SIU 

_ 1 

MTU 

MTU 

I/O 


Multiplex 

Command 

Terminal 


Advantages 

• Growth  Capability 

• Parts  Commonality 

• High  Data  Capacity 

• Short  Circuit  Isolation 


Symbol  Code 

SIU  = Sensor  Interface  Unit 
MTU  = Multiplex  Terminal  Unit 
I/O  = Input/Output 

S = Sensor,  Controller 

Transducer  or  Actuator 

Disadvantages 

• High  Relative  Complexity 

• High  Relative  Cost 


i 


Figure  35 

Party  Line  Multiplex  Network 


not  appear^to'be^warranteda0mPleXlLy  ““  C°St  °f  thls  '*>'  °£  "«work  does 

Figure  36,  Area  Multiplex,  represents  a middle  ground  with  respect  to  fWfMi 

m lndlcata  that  - — ™ --- 
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Advantages 

• Moderate  Complexity 

• Moderate  Cost 

• Moderate  Data  Capacity 


Disadvantages 

• Not  Easily  Expanded 

• Limited  Growth 


Figure  36 
Area  Multiplex 


Outer  Loop 


Inner  Loop 


To  Flight 

Control 

Computer 


Symbol  Code 

SIU  = Sensor  Interface  Unit 
MTU=  Multiplex  Terminal  Unit 
I/O  = Input/Output 

S = Sensor,  Controller,  Transducer  or  Actuator 


Advantages 

• Low  Relative  Cost  and  Complexity 

• Time  Shared  A/D  Conversion 

• Simplified  Digital  Signaling 

• Simplified  Time-Slot  Address 


Disadvantages 

• Common-Mode  Sampling 

• Limited  Data  Capacity 

• Short  Circuit  Susceptibility 


Figure  37 

Central  Digital  Interface  with  Display  and  Flight 
Management  Computer  Multiplex 
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Figure  37,  Central  Digital  Interface  with  Display  and  Flight  Management  Computer 
Multiplex,  represents  a network  which  uses  dedicated  wiring  for  the  redundant  sensors, 
transducers,  and  actuators,  but  utilizes  multiplexing  for  the  non-redundant  display 
and  other  simplex  outer  loop  sensors  which  are  utilized  by  the  Digital  FCS.  This 
scheme  makes  the  redundant  flight  control  system  compatible  with  use  of  a party  line 
multiplex  network  which  is  connected  to  the  display  and  flight  management  computers, 
which  in  turn  are  connected  to  the  outer  loop  sensors  of  the  aircraft.  Multiplexing 
in  thj.s  area  may  offer  advantages  because  it  is  likely  that  the  outer  loop  sensors  in 
advanced  aircraft  will  be  connected  by  a multiplex  network  and  it  is  also  more  likely 
that  any  growth  of  the  flight  control  system  after  initial  installation  will  occur  in 
the  area  involving  simplex  outer  loop  equipment.  For  example,  additional  automatic 
modes  might  be  added  to  the  flight  control  system  by  providing  additional  inputs  to 
the  Digital  FCS  over  the  abovementioned  multiplex  transmission  line. 

2-8-2  TRANSMISSION  METHODS  - Analysis  indicates  that  the  transmission  method  which 
is  most  appropriate  for  the  Digital  FCS  is  a transformer-coupled,  balanced  transmis- 
sion line  to  provide  a high  degree  of  noise  rejection.  The  balanced  line  also  per- 
mits use  of  a twisted-shielded-pair  to  minimize  mutual  coupling  of  noise  fields. 
Biphase-level  (Manchester  II)  baseband  signaling  is  used  to  provide  low  bit-error- 
rate  and  self  clocking  operation. 

2*8.3  DATA  BUS  OPERATION  - The  data  bus  operation  recommended  for  the  Digital  FCS 
is  a command- response  type  control  to  transfer  sensor  data  to  a central  digital 
processor  in  response  to  software  initiated  commands.  Consequently,  data  is  con- 
stantly available  for  processing  at  the  current  sequence  in  the  computational  cycle. 
Asynchronous  decoding  uses  the  inherent  signal  transition  in  each  bit  of  biphase 
data  to  establish  timing. 

Since  timing  in  the  asynchronous  receiver  is  derived  directly  from  the  data  bit 
stream,  there  is  no  need  for  external  sources  of  timing.  In  contrast,  the  propaga- 
tion delay  between  clock  and  data  in  synchronous  operation  imposes  a practical  limit 
on  transmission  line  length. 

2*8.4  MULTIPLEX  TERMINAL  - The  recommended  multiplex  terminal  arrangement  is  an 
asynchronous  biphase  integrating  receiver.  The  integration  technique  is  used  to 
measure  time  between  axis  crossings;  consequently,  a significant  pulse-to-pulse 
jitter  can  be  tolerated  without  causing  errors  in  the  detection  process.  As  a 
result,  the  integrating  receiver  has  a lower  bit-error-rate  for  a given  signal  to 
noise  level  than  pulse-gated,  one-shot  receivers. 

2.8.5  CONCLUSIONS  - The  analysis  indicated  that  multiplexing  of  the  redundant, 
analog  inner  loop  sensors,  transducers  and  actuators  was  not  justified  because  of 
the  relative  simplicity  of  the  wiring  and  low  probability  of  changes  after  initial 
system  verification. 

Multiplexing  between  the  digital  interface  unit,  and  the  display  and  flight 
mangement  computers  appears  to  be  appropriate  and  advantageous.  The  transmission 
methods,  data  bus  operation  and  terminal  configurations  were  determined.  The 
multiplexing  techniques  recommended  are  compatible  with  MIL-STD-1553. 


2.9  LIGHTNING  PROTECTION 


The  lightning  protection  scheme  and  analysis  for  the  Digital  FCS  aircraft  is 
summarized  in  the  following  paragraphs. 

2-9,1  THREAT  DEFINITION  - A lightning  strike  threat  for  the  Digital  FCS  aircraft 
was  defined.  The  lightning  strike  model  is  presented  in  Table  5 and  Figure  38.  A 
comparison  between  the  Digital  FCS  lightning  strike  model  and  the  lightning  model 
of  MIL-B-5087  is  presented  in  Table  6. 

Table  5 


Digital  FCS  Lightning  Strike  Model 


Return  Strokes 

Intermediate 

Current 

Model 

Continuing 

Current 

Stroke 

Order 

Peak 

Current 

(kA) 

Charge 

(C) 

Time 

Between 

Strokes 

(ms) 

Model 
Current,  l0 
(kA) 

lj 

ikA) 

Charge 

(C) 

(A) 

Charge 

(C) 

1 

200<4> 

~12 

206 

9 

—8 

60 

2 

100 

~ 6 

103 

9 

~8 

60 

3 

100 

~ 6 

103 

0 

0 

Final 

Stage  (3) 

400 

-160 

Total  Charge 
Transformed 

-24(1) 

-16(1) 

~160d> 

(1) =  Total  Charge  Transferred  s 200C,  Total  Strike  Duration  = 0.5  sec 

(2) =  The  time  history  for  all  strokes  is  defined  by  I (t)  = l0  (e^-e-^)  + lj  (e'Tf-e-^) 

with  a = 1.7  x 104s-1  (3  = 3.5  x 106°s_1  7=  103  s-1  6 = 104  s_1 . The  time  to  peak 
current  is  1 .5  ^s  for  all  strokes.  The  time  to  half-value  is  40  jjs  for  all  strokes. 

(3) =  Final  stage  continuing  current  (lc)  duration  = 400  ms 

(4) =  Action  integral  = 1 .9  x 106  ampere2  - seconds 


The  rationale  for  utilizing  this  model  is  summarized  as  follows: 

o It  is  representative  of  the  highest  currents  to  be  expected  (98%  of  the 
strike  data  surveyed  is  lower). 

o The  rise  time  is  representative  of  the  fastest  rate  of  rise  expected  and  is 
still  practical  for  simulation  (98%  of  probable  strikes  will  be  slower). 

o The  number  of  strokes  per  strike,  interval,  half  amplitude  decay  time  and 
coulomb  transfer  represent  mean  values.  This  is  considered  appropriate 
since  a high  performance  aircraft,  even  at  landing  speed,  will  have  trav- 
eled through  an  established  strike  channel  in  less  than  one  half  second. 

o The  model  assumes  a subsystem  is  sensitive  to  high  peak  currents,  high  total 
charge  transfer,  high  di/dt,  high  charge  transfer  in  a single  stroke,  and 
insensitive  to  stroke  interval.  In  the  latter  case,  in  the  event  that  sub- 
system information  rates  are  considered  a factor,  the  interval  may  be  varied 
to  evaluate  vulnerability. 


.. 
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Figure  38 

Digital  FCS  Lightning  Strike  Model 


Table  6 

Lightning  Strike  Model  Comparison 


Lightning  Strokes/Strike 
Peak  Current  (kA) 

Rate  of  Rise  (kA/ps) 

Follow  on  Current 
Total  Coulomb  Transfer 
Mean  Decay  Time  to  1/2  Value  (ps) 
Intermediate  Current  Level  (kA) 


Estimated  Percent  of  Lightning 
Strikes  Covered 


MIL-B-5087 

Digital  FCS  Study* 

1 

3 

200 

200 

100 

133 

None 

400  A for  380  ms 

5.5 

200 

20 

40 

None 

9 

10% 

50%  (Mean) 

■ » o — 

Stanford  Research  Institute  Contract 
Report  L.S.  -281 7-A  3 August  1972 


kA  - 1000  amperes 
ms  - millisecond 
US  - microsecond 
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2.9.2  ATTACH  ZONES  - Lightning  strike  attachment  on  any  aircraft  can  be  divided 
into  zones.  There  are  four  basic  aircraft  lightning  zones.  These  are: 

o Direct  attachment  zones, 
o Swept  stroke  zones, 
o Current  transfer  zones,  and 
o Clear  zones. 

Direct  attachment  zones  of  interest  are  those  where  lightning  initially 
attaches  or  exits.  These  are  the  nose,  canard  tips,  wing  tips,  wing  pylons  and 
stores,  and  empennage  extremities  (rudder  and  stabilator  tips).  It  can  be  shown 
that  on  a high  performance  jet  aircraft,  configuration  dependent  electrostatic 
criteria  will  limit  the  direct  attachment  points  to  those  mentioned  with  very  few 
exceptions.  A swept  stroke  zone  is  an  area  in  which  a lightning  stroke  is  swept 
back  from  the  initial  attach  point  by  the  airstream.  This  is  the  direct  result  of 
the  aircraft  flying  through  or  away  from  an  established  lightning  channel.  The 
swept  stroke  zones  are  easily  defined  as  the  locations  behind  direct  attach  zones 
such  as  fuselage  and  possibly  the  wing  torque  box.  The  current  transfer  zone  is 
an  area  through  which  lightning  current  passes,  but  which  is  outside  of  the  direct 
attachment  or  swept  stroke  zones.  These  areas  must  transfer  the  lightning  current 
between  the  attach  and  exit  points.  The  remaining  area  is  a clear  zone.  These 
are  areas  where  lightning  does  not  attach  and  associated  current  does  not  pass 
through.  For  the  lightning  vulnerability  study,  the  only  zone  of  interest' is  the 
current  transfer  zone. 


2 -9:?  VULNERABILITY  EVALUATION  - The  lightning  strike  threat  described  above  was 
applied  analytically  to  the  Digital  FCS.  Quantitative  values  of  voltage  and  time 
duration  of  electrical  transients  resulting  from  the  assumed  lightning  strike  model 
were  calculated  and  are  summarized  in  Table  7. 

The  vulnerability  analysis  thus  identified  potentially  vulnerable  wires  and 
circuits  and  the  magnitude  of  the  potential  lightning  transients. 

2;9-4  PROTECTIVE  MEASURES  DEFINITION  - Having  determined  the  potentially  vulnerable 
wires  and  circuits  of  the  Digital  FCS,  protective  measures  were  devised  in  an 

attempt  to  cope  with  the  potentially  disruptive  effects  of  the  assumed  lightning 
strike. 2 * * *  6 * * 


It  is  planned  that  the  results  of  this  analysis  will  be  used  to  provide 
specification  requirements  relative  to  lightning  protection  measures  for  Digital 
FCS  equipment  and  provide  guidelines  for  aircraft  design  so  that  appropriate 
lightning  protection  will  be  provided  in  the  Digital  FCS  test  aircraft. 

2-9;5  .T.EST  CRITERIA  AND  FACILITIES  - A summary  of  lightning  test  criteria  and 

acilities  appropriate  to  verify  the  lightning  protection  provisions  of  the  Digital 

FCS  aircraft  was  prepared.  The  analysis  indicated  that  full  scale  (high  current 

and  high  voltage)  lightning  tests  on  the  complete  aircraft  would  provide  the  most 

credible  data  relative  to  vulnerability  to  lightning.  However,  it  is  recognized 

that  full  scale  lightning  tests  involve  potential  risk  to  the  aircraft  and/or  the 

installed  equipment  being  evaluated.  It  was  further  concluded  that  nondestructive, 
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Table  7 

Lightning  Vulnerability  Analysis  Summary 


Circuit  Identification 

Induced 

Voltage/Current 

Duration 

Function 

Affected 

Circuit 

Damage 

Potential 

Multiplex  Transmission  Line 
(Forward  Area) 

(Full  Fuselage) 

- 

15.6V 
26  V 

= 1 ps 
= 1 ps 

Yes 

Yes 

Marginal 

Marginal 

Secondary  Actuator  Servo  Valve 

6 pa 

= 150  ps 

No 

Marginal 

Secondary  Actuator  Pnsition 
Feedback 

2.5  V 

Secondary  0.3V 

— 1 PS, 

4.25  kHz  1 Cyc 

No 

No 

Secondary  Actuator 
Demodulator 

30.5V 

Secondary  5V 

= 1 ps 
= 40  ps 

No 

Marginal 

No 

Input  to  Secondary  Actuator 
Shut  Off  Valve  and  ^P  and 
Position  Primaries 

61V 

= 1 ps 

No 

No 

Side  Stick  Command  Demodulator 

18V 

Secondary  5V 

= 1 ps 

8.8  kHz  1 Cyc 

No 

Marginal 

Rate  Gyro  Demodulator 

36V 

= 1 ps 

No 

Marginal 

Accelerometer 

36  V 

= 1 ps 

No 

Marginal 

Rudder  Pedal  Transducer 

36  V 

= 1 ps 

No 

Marginal 

DC  Power 

5 7Vx105 

Secondary  3.0Vx10^ 
(Opposite  Polarity) 

= 1 ps 

= 160  ps 

Yes 

Yes 

Marginal:  Voltage  or  current  is  below  damage  or  upset  level  but  within  the  safety  margin 
of  10  to  1 


transient  analysis  type  lightning  testing  would  provide  data  which  could  be  extrapo- 
lated to  estimate  the  potential  effects  of  full  scale  lightning  strikes.  It  is 
planned  that  transient  analysis  tests  will  be  conducted  on  the  test  aircraft. 

2.9.6  COMPOSITE  STRUCTURE  CONSIDERATIONS  - Composite  materials,  which  possess 
superior  structural  properties  when  compared  to  conventional  metallic  materials, 
are  being  developed  for  use  in  future  tactical  aircraft.  The  composite  materials 
currently  being  developed  and  evaluated  are  vulnerable  to  lightning  strike  damage, 
and  may  provide  little  or  no  lightning  protection  for  wiring  or  equipment  installed 
behind  them. 

The  most  common  composite  materials  being  considered  at  this  time  are  boron 
epoxy  and  graphite  epoxy.  When  compared  to  metal,  these  composite  materials  are 
poor  conductors  of  electrical  current.  This  relatively  poor  conductivity  is  the 
reason  for  their  vulnerability  to  lightning. 

The  effect  of  lightning  on  a tactical  aircraft,  utilizing  composite  structural 
parts  ar.d  fly-by-wire  flight  control,  is  basically  two-fold.  First,  lightning  may 
cause  structural  failure  of  the  composite  structure  and  this  effect  presents  a 
hazard  to  the  flight  integrity  of  the  aircraft.  Secondly,  lightning  may  penetrate 
a composite  structural  part  of  the  aircraft  and  enter  directly  or  induce  an  effect 
in  the  fly-by-wire  flight  control  system. 
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Investigation  of  composite  protection  methods  reveals  seven  basic  approaches 
which  are: 

o Thin  metal  strips  over  the  composite  area  separated  by  a dielectric  coating, 
o Overall  metal  coating  of  the  composite  area, 
o Metal  mesh  overlays, 
o Bus  bars, 

o Graduated  impedance  ionization  strips, 
o Diversion  (around  or  away) , and 
o Dielectric  coatings. 

When  replacing  portions  of  an  airframe  with  composites,  specific  approaches  will  be 
required  to  provide  solutions  for  the  specific  problem  areas.  The  protection 
approach  considered  for  any  particular  composite  area  or  structure  is  dependent 
upon  the  zone  of  interest. 

One  point,  which  becomes  apparent,  is  that  all  of  the  suggested  lightning 
protection  techniques  end  up  adding  weight  to  the  aircraft.  The  weight  of  lightning 
protection  provisions  should  be  added  to  the  weight  of  the  composite  in  determining 
overall  weight  advantage  of  the  composite  over  conventional  metal  construction. 

Once  the  approach  is  established  the  primary  objective  is  still  to  keep  light- 
ning currents  out  of  composites  and  direct  the  current  to  metallic  structure  for 
diversion  and  control.  In  addition,  the  current  transfer  paths  across  composite 
structures  from  the  attach  points  to  the  airframe  must  be  designed  with  as  few  bends 
or  twists  as  possible  to  reduce  the  resultant  inductance  to  a minimum. 

2.9.7  CONCLUSIONS  - A lightning  strike  threat  model  was  selected.  The  model  was 
used  to  analytically  evaluate  vulnerability  of  representative  DFCS  circuits.  Pro- 
tective measures,  aimed  at  reducing  vulnerability  of  circuits  identified  as  poten- 
tially susceptible  were  summarized.  Considerations  relative  to  lightning  testing 
and  composite  structure  considerations  were  evaluated.  The  approach  used  in  the 
lightning  protection  analysis  proved  to  be  satisfactory,  and  appears  to  provide  a 
coherent  approach  for  defining  lightning  protection  design  and  test  criteria  for  a 
digital  or  analog  fly-by-wire  system  in  any  fighter  type  aircraft. 
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2.10  ELECTROMAGNETIC  COMPATIBILITY  (EMC) 


An  EMC  analysis  of  equipment  of  the  types  needed  to  implement  the  DFCS  was 
conducted.  The  EMC  analysis  considered  equipment  and  wiring  to  implement  both 
analog  and  digital  signal  transmission.  Particular  attention  was  directed  toward 
equipment  which  was  different  from  that  used  to  implement  the  SFCS,  e.g.,  digital 
computers  and  electronic  displays. 

A conventional  scheme  for  implementation  of  EMC  of  the  DFCS  has  been  identified 
and  is  summarized  below. 

2.10.1  EMC  BONDING  TECHNIQUES  - Electrical  bonding  is  recommended  for  application 

to  the  DFCS  and  aircraft  per  MIL-B-5087B  as  provided  by  MCAIR  Process  Specifications. 
Electrical  bonding  consists  of  direct  metal-to-metal  contact  of  DFCS  related  compo- 
nents (units-to-structure , shields-to-chassis)  to  provide  a low  impedance  path. 

This  will  help  ensure  that  the  DFCS  system  and  subsystems  are  electrically  stable 
and  free  from  static  discharge  and  electrical  shock  hazards.  In  addition,  bonding 
establishes  the  equipotential  base  for  DFCS  radio  frequency  (RF)  emission  control 
and  suppression. 

2.10.2  EMI  GENERATION  AND  SUSCEPTIBILITY  CONTROL  - It  is  recommended  that  control 
of  DFCS  equipment  EMI  generation  and  susceptibility  be  accomplished  through  the 
application  of  appropriate  portions  of  MIL-STD-461,  Notice  3 and  MIL-STD-462, 

Notice  2 (subsystem  electromagnetic  interference  control  design  and  test  require- 
ments respectively)  on  all  DFCS  and  related  equipment.  For  those  subsystem  units 
which  have  been  previously  developed  to  earlier  specifications,  parts  of  MIL-STD-461, 
and  462  will  be  specified  to  establish  the  same  EMC  confidence  as  the  newly  developed 
equipment . 

2.10.3  EMC  GROUNDING  PROVISIONS  - It  is  recommended  that  the  grounding  technique 
for  the  DFCS  adhere  to  the  single  point  ground  concept  for  all  DFCS  circuits  includ- 
ing the  DFCS  power  control,  with  the  exception  of  RF  shields.  This  concept  requires 
that  all  subsystem  interface  circuits  be  grounded  at  one  end  only  and  be  electri- 
cally isolated  for  both  AC  and  DC  at  the  other.  It  is  planned  that  the  single  point 
ground  concept  will  be  specified  to  all  subsystem  manufacturers.  The  single  point 
grounding  of  interface  circuits  will  help  to  eliminate  ground  plane  induced  noise 

in  the  system. 

2.10.4  EMC  AIRCRAFT  WIRING  TECHNIQUES  - Aircraft  wiring  guidelines  will  recommend 
that  analog  and  digital  flight  control  signal  circuits  be  shielded.  It  is  planned 
that  noise  generation  and  immunity  in  power  and  discrete  logic  wires  will  be  con- 
trolled by  filtering  and  that  the  shields  of  DFCS  analog  circuits  will  be  grounded 
at  the  signal  source  end  (or  interface  ground  point)  for  maximum  effectiveness. 

Tt  is  also  planned  that  digital  circuits  will  have  RF  shields  grounded  at  both  ends 
and  at  all  breaks.  RF  shields  are  recommended  because  digital  signals  have  high 
frequency  components  due  to  the  fast  rise  and  fall  times  of  the  information 
transfer . 

Wire  or  cable  separation  is  another  aircraft  wiring  technique  available  for 
EMI  control.  Of  particular  concern  in  aircraft  wire-to-wire  coupling  analysis  are 
the  aircraft  primary  power  and  RF  transmission  lines.  To  reduce  the  probability  of 
these  lines  affecting  the  DFCS,  their  routing  will  be  maintained  at  least  six 
inches  from  DFCS  wiring  and/or  cabling  where  feasible. 
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2.10.5  SUBSYSTEM  INTERFACE  CONTROL  - Without  interface  control,  other  EMC  design 
considerations  are  either  partially  or  totally  ineffective.  Interface  control 
involves  establishing  system  input  or  output  circuit  configurations  with  EMC  as  an 
objective.  One  of  the  better  circuit  configurations  for  common  mode  noise  rejection 
and  utilization  of  other  EMC  techniques  is  a balanced  pair  (source  and  return)  with 
respect  to  ground.  It  is  therefore  planned  that  all  DFCS  digital  lines  will  utilize 
this  type  of  interface. 

2.10.6  CONTROL  OF  DEGRADING  EFFECTS  OF  AIRCRAFT  ENVIRONMENT  - Control  of  degrading 
effects  of  the  aircraft  environment  on  the  DFCS  requires  maintenance  of  the  fuselage 
as  a continuous,  low  impedance,  enclosed  structure  thereby  providing  an  equipotential 
ground  plane  for  RF  shielding.  It  is  planned  that  structural  discontinuities  such 

as  hinged  doors  and  inspection  cover  plates  will  be  examined  to  ensure  that  proper 
bonding  is  maintained.  Any  non- conductive  skin  section  additions  will  be  analyzed 
to  determine  if  aircraft  and  DFCS  wiring  or  equipment  should  be  relocated. 

2.10.7  CONCLUSIONS  - The  EMC  techniques  summarized  above  provide  comp 'ehensive 
coverage  against  EMI  relative  to  the  DFCS  installation.  Total  system  testing  will 
generally  follow  MIL-E-6051D.  Implementation  of  EMC  based  on  the  scheme  summarized 
above  has  proved  to  be  adequate  on  current  and  past  programs  at  MCAIR.  There  is 
always  some  potential  for  problems  resulting  from  inadequate  EMC  on  an  ADP  such  as 
DFCS.  However,  it  is  anticipated  that  with  proper  attention  to  the  schemes  and 
guidelines  summarized  above,  satisfactory  EMC  will  be  achieved. 


74 


^ X.A. 


. . - 

-- 


2.11  BUILT-IN  TEST  AND  INFLIGHT  INTEGRITY  MANAGEMENT  (BIT  AND  IFIM) 


2.11.1  GENERAL  - As  used  in  this  report,  BIT  is  a sequence  of  tests  conducted  on 
the  ground  to  validate  and/or  troubleshoot  the  system.  IFIM  is  a sequence  of  tests 
conducted  while  the  system  is  operating, to  monitor  performance.  The  BIT  and  IFIM 
studies  were  conducted  in  conjunction  with  the  Redundancy  Management  and/or  IFIM 
Analyses.  The  areas  of  investigation  for  these  studies  were  complementary.  The 
redundancy  management  and/or  IFIM  analyses  summary,  Section  2.12,  addresses  the 
areas  of  common  interest  and  specifically  covers  the  IFIM.  The  functions  of  pilot 
preflight,  maintenance  preflight,  and  maintenance  troubleshooting  are  combined  into 
a single  test  program  with  subroutines  for  expanded  tests  as  discussed  in  the 
following  paragraphs. 


2.H.2  BUILT-IN- TEST  - The  Built-In  Test  (BIT)  is  planned  to  be  designed  to  permit 
rapid  and  positive  organizational  level  maintenance  of  the  DFCS , without  the  need 
for  special  test  equipment  or  highly  skilled  technical  personnel.  Fault  detection  to 
a module  level  is  not  planned.  Detected  LRU  faults  will  be  reported  and  identified. 
Electronics  can  be  tested  and  fault  isolated  with  or  without  application  of  hydraulic 
power.  This  provides  for  a reduction  in  actuator  wear,  minimizes  manhours  to  repair, 
minimizes  AGE  or  GSE  requirements,  facilitates  deck  handling,  and  increases  aircraft 
availability. 


BIT  will  be  inhibited  by  series  interlocks.  A BIT  initiate  switch  must  be 
energized  external  to  the  cockpit  by  a ground  crewman  before  the  cockpit  BIT  initi- 
ate switch  can  be  energized.  This  is  to  permit  visual  checks  from  ground  level  to 
assure  that  all  surfaces  are  clear  and  safe  to  operate.  Additional  provisions  will 
be  implemented  to  preclude  inadvertent  activation  of  the  BIT  program  in  flight. 


BIT  verification  will  be  by  analysis  and  by  test.  It  is  planned  that  the  BIT 
verification  test  will  evaluate  functional  failures  based  upon  a failure  modes  and 
effects  analysis  and  a hazard  analysis  which  identify  all  failures.  Flight  safety 
and  mission  critical  failures,  and  a random  selection  of  faults  will  be  induced  in 
the  equipment  to  verify  that  the  monitoring  schemes  are  capable  of  detecting  and 
isolating  faults  to  the  desired  levels. 


The  time  to  perform  BIT,  excluding  time  for  test  preparation,  is  estimated  to 
be  as  follows: 


BIT  (with  hydraulics) 


= 20  seconds  (triplex) 

= 29  seconds  (quadruplex) 


BIT  (without  hydraulics)  = 10  seconds 


The  BIT  scheme  is  planned  to  be  a software  controlled  test.  Maximum  use  will 
be  made  of  IFIM  monitors  to  detect  and  isolate  faults.  Dynamic  stimuli  will  be 
inserted  at  discrete  intervals  during  the  test  in  order  to  exercise  those  elements 
of  the  system  that  are  not  amenable  to  static  test.  Sensors,  controllers  an 
actuators  will  be  exercised  and  the  resulting  outputs  compared,  voted,  and  in-line 
monitored  to  check  proper  operation.  The  computers  will  be  self-tested,  cross- 
channel monitored  and  voted.  Fault  isolation  subroutines  will  be  automatically 
initiated  when  a test  failure  result  is  ambiguous.  Failure  threshold  settings  for 
BIT  may  be  tighter  than  IFIM  in  order  to  detect  marginal  conditions  or  incipient 

failures . 


The  overall  BIT  scheme  flow  diagram  is  illustrated  in  Figure  39- 
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Figure  39 

Top  Level  Flow  Diagram  Depicting  Preflight  BIT 


2.11.3  INFLIGHT  INTEGRITY  MANAGEMENT  (IFIM) 


IFIM  will  be  implemented  using 

in-line  monitoring,  cross-channel  monitoring  and  data  reasonableness  as  discussed 
in  Section  2.12. 


2.11.4  DEDICATED  HARDWARE  VS  SOFTWARE  FOR  BIT  AND  IFIM 


Signal  conditioning  requirements  were  identified  which  could  only  be 
accomplished  by  hardware.  These  functions  are  not  candidates  for  imple 
mentation  in  software. 


Monitoring  tasks  which  can  be  accomplished  by  hardware  or  software,  can  be 
accomplished  equally  well  by  hardware  or  software.  Performance  was  there- 
fore not  a trade-off  issue. 
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o Implementation  of  monitoring  tasks  in  hardware  rather  than  software  always 
results  in  a higher  channel  failure  rate  (because  of  the  failure  rate  of  the 
added  parts)  and  consequently  results  in  a higher  probability  of  loss  of 
control. 

o Monitoring  of  analog  signals  can  be  more  easily  accomplished  by  a hardware 
monitor  (no  analog  to  digital  conversion  is  required).  However,  no  require- 
ment for  monitoring  a signal  where  both  the  input  and  output  were  in  ana  og 
form  were  identified. 

o There  is  no  known  way  to  accomplish  the  actuator  monitoring  scheme  presented 
in  Section  2.12.7  using  hardware. 

o Examples  of  monitors  which  are  planned  to  be  implemented  in  hardware  include: 
o Power  supply  monitors , and 
o Dead  man  timers. 

2.11.5  CONCLUSIONS 

o BIT  should  be  a manually  initiated,  software  controlled  test. 

o IFIM  monitors  should  be  used  to  detect  faults. 

o BIT  should  be  carefully  designed  to  assure  that  BIT  operation  in-flight  is 
inhibited. 

o A BIT  Verification  Test  should  be  performed  as  part  of  the  Flight  Worthiness 
Test  to  validate  the  BIT  design. 

o Whenever  there  is  a choice  between  hardware  and  software  for  implementation 
of  a BIT  or  IFIM  monitor,  a software  monitor  should  be  used. 
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2.12  REDUNDANCY  MANAGEMENT  AND/OR  IFIM  ANALYSIS 

2.12.1  GENERAL  - Redundancy  management  and  IFIM  are  defined  as  follows: 


In  Order  to  Assure  Safe  Aircraft  Operation  and  Achieve  a Required  High 
Probability  of  Mission  Success,  Redundant  Flight  Control  Units  (Computers, 
Sensors,  Actuators,  etc)  and  Redundant  Channels  are  Required. 

The  Proress  by  Which: 

• System  Units  are  Monitored, 

• Faulty  Units  are  Detected  and  Isolated  from  the  System,  and 

• The  Remaining  Good  Units  are  Reconfigured 

Is  Defined  as 

Redundancy  Management 

Functional  Implementation  of  this  Process  Includes: 

• Cross-Channel  Monitoring,  and 

• In-Line  Monitoring,  and 

Is  Defined  as 

In-Flight  Integrity  Management  (IFIM) 

When  Implemented  Properly,  the  FBW  System  will  be 

Fault  Tolerant 


Figure  40  shows  that  faults  are  detected  by  cross-channel  and  in-line  monitoring 
and  that  recovery  from  faults  is  achieved  by  system  reconfiguration.  Some  important 
considerations  in  implementing  cross-channel  monitoring  are  shown  in  Figure  41. 
Similarly,  some  important  considerations  involved  in  in-line  monitoring  are  shown  in 
Figure  42.  Some  techniques  that  can  be  used  to  reconfigure  the  Digital  FCS  to  iso- 
late and  recover  from  faults  are  given  in  Figure  43. 

Six  initial  candidate  configurations  were  selected  for  analysis  by  MCAIR  and 
three  subcontractors  (GE,  Honeywell  and  Lear  Siegler).  The  initial  candidates 
ranged  in  complexity  from  simplex  to  quadruplex  and  other  arrangements  with  degrees 
of  redundancy  between  the  two  extremes. 

After  preliminary  analysis  of  the  initial  candidates,  three  sound  candidates 
were  selected  for  detailed  investigations  of  safety,  mission  performance,  flexibility, 
pilot  factors,  reliability,  survivability,  maintenance  and  relative  cost.  Figure  44 
illustrates  the  approach  to  Configuration  Development  and  lists  the  initial  and  sound 
candidate  configurations. 
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Faults  are  Detected  by: 

• Cross-Channel  Monitoring 

• Yields  High  Coverage  (-*■  100%)  of  First  Fault 

• Minimum  Disruption  of  Normal  System  Operation 

• In-Line  Monitoring 

• Provides  Fail  Operational  Capability  with  Two  Channels 

Faults  are  Isolated  and  Recovery  from  Faults  is  Achieved  by: 

• System  Reconfiguration 


Figure  40 

Fault  Detection  and  Isolation 


• Number  of  Voting  Planes 

• Sensor  and  Controller  Inputs  to  Computer 

• Intermediate  Computed  Parameter 

• Computer  Outputs  to  Actuators 

• Computer  Monitoring  of  Actuators 

• AP  Comparison 

• Redundant  Data  Comparison  and  Voting 

• Signal  Selection 

• Averaging 

• Computer  Synchronization 

• Bit  by  Bit 

• Frame 

• Comparison  of  Intermediate  Computational  Results 

• Asynchronous 

• Computer  Interchange  of  Redundant  Data 


Figure  41 

Important  Considerations  in  Cross-Channel  Monitoring 
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• Computer  Self-Test 

• Computer  Test  of  Sensors  and  Controllers 

• Data  Reasonableness 

• Torquers 

• Dither 

• Computer  Test  of  Actuators 

• Actuator  Models 

• Computer  Test  of  I/O  and  Multiplex 

• Parity 

• Wraparound 

• Rebound 

• Computer  and  Hardware  Test  of  Power  Supplies 

• Data  Reasonableness 


Figure  42 

In-Line  Monitoring  Considerations 


• Isolate  Failed  Element 

• Code  Input  Data  from  Failed  Element  to  Identify  it  as  Invalid 

• Computer  and  I/O  Restoration 

Two  Examples: 

• Transient  Failure  Temporarily  Affects  a Computation 
Solution:  Program  Rollback 

• Data  in  Memory  is  Permanently  Altered 
Solution:  Reload  Memory  from  Good  Computer 

• Alter  Modes 

• Substitute  Prime  Data  Source  with  Computed  Data 

• Change  Gains  to  Compensate  for  Faults 

• Alter  Priority  of  Computations 


Figure  43 

System  Reconfiguration  Techniques 
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for  sensors,  computers,  and  actuators  respectively 


Figure  44 

Configuration  Development 

2.12.2  REDUNDANCY  MANAGEMENT  REQUIREMENTS  AND  ISSUES  - Analyses  were  conducted  to 
establish  a redundancy  and  fault  tolerant  scheme  for  the  candidate  DFCS  configura- 
tions. The  analyses  have  considered  the  issues  that  are  summarized  in  the  following 
paragraphs . 

2.12.2.1  Coverage 

Objective 

The  objective  of  this  study  was  to  show  the  effect  of  coverage  on  the  probability 
of  loss  of  control  function.  Coverage  is  the  probability  of  detecting,  isolating, 
and  recovering  from  a fault  or  failure. 

Conclusions 


o The  first  fault  coverage  for  a triplex  system  and  the  first  and  second  fault 
coverage  for  a quadruplex  system  must  be  high  (greater  than  0.99985)  as 
shown  in  Figure  45. 

o High  first-fault  coverage  (essentially  1.0)  can  be  achieved  using  force- 
summed  secondary  actuators  because  the  minimum  coverage  is  equal  to  the 
reliability  of  the  isolation  device  (3  x 10”^  failures  per  operating  hour). 

o The  equation  for  second  fault  coverage  in  a triplex  system  is  given  in 

Figure  46.  For  the  set  of  representative  coverage  and  failure  rate  numbers 
shown,  the  second  fault  coverage  is  0.944. 
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o Given  a first  fault  coverage  of  one  and  the  set  of  failure  rates  and 

coverages  of  Figure  46,  the  failure  probability  of  a triplex  system  is  less 
than  that  allowed  by  the  SOW  (one  failure  per  1.5  million  operating  hours)l. 
This  is  shown  in  Figure  47.  This  demonstrates  the  feasibility  of  a triplex 
DFCS  using  in-line  monitoring  of  second  fault  failures. 

o A group  of  generic  quadruplex  and  triplex  systems  are  compared  in  Figure  48. 
Quadruplex  system  Q-l  has  a third  fault  coverage  of  0.95.  To  achieve  this 
level  of  coverage  requires  the  same  in-line  monitoring  techniques  used  in 
the  triplex  system.  System  Q-2,  on  the  other  hand,  requires  only  a simple 
"heads-or-tails"  test  for  third  fault  coverage.  Since  its  probability  of 
loss  of  control  is  much  better  than  required  (one  failure  per  1.5  million 
operating  hours) , it  would  appear  to  be  the  preferred  quadruplex  system. 
Triplex  system  T-l  has  a second  fault  coverage  of  0.95  which  is  conserva- 
tive and  readily  achievable  with  known  in-line  monitoring  techniques.  It 
is  theoretically  possible  to  achieve  a second-fault  coverage  of  0.99  and  the 
probability  of  loss  of  control  shown  by  T-2.  For  any  triplex  system  to  have 
as  low  a probability  of  loss  of  control  as  quadruplex  system  Q-2  requires  a 
second  fault  coverage  of  0.9996  (system  T-3)  which  is  extremely  unlikely. 

NOTE  1:  The  Statement  of  Work  reliability  goal  is  no  more  than  two  failures 
per  10^  flight  hours.  For  purposes  of  the  analysis  it  was  assumed 
that  the  ratio  of  operating  hours  to  flight  hours  was  three.  The 
SOW  therefore  requires  no  more  than  2 failures  in  3 x 106  operating 
hours  or  no  more  than  1 failure  in  1.5  x 10^  operating  hours. 


Figure  45 

The  Importance  of  Coverage 
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Figure  46 

Second  Fault  Coverage  (X2)  in  a Triplex  System 


Note:  First  Fault  Coverage  - 1 .0 

Coverage  = the  Probability  of  Detecting,  Isolating  and  Recovering  from  Failures 


Figure  47 

Triplex  System  Failure  Probabilities 
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Figure  48 

Comparison  of  Quadruplex  and  Triplex  System  Reliabilities 


2.12.2.2  Distribution  of  Redundancy  Management  Functions  Among  Software,  1/0  and 
Actuator  Interface  Units 


Objective 

The  objective  of  the  study  was  to  define  the  redundancy  management  functions  to 
be  mechanized  in  software  and  in  hardware. 

Conclusions 


o If  hardwired  cross-strapping  of  sensors  is  done  (in  addition  to  sensor 

digital  data  exchanges),  comparison  monitoring  and  signal  selection  should 
be  done  in  hardware  to  keep  the  computation  load  down. 

o If  only  data  exchanges  are  used  for  sensor  crossfeed,  then  the  following 
conclusions  are  reached: 
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o For  a quadruplex  system,  neither  a hardware  nor  a software  mechanization 
shows  significant  advantages  over  the  other. 

o For  a triplex  system,  the  computational  load  is  reasonable  and  sensor 
redundancy  management  should  be  done  in  software. 

o Secondary  actuator  monitoring,  equalization,  and  mode  engage  logic  should  be 
done  in  software  to  provide  hardware  savings  and  ease  of  fault  isolation 
and  preflight  self-test. 

2.12.2.3  Pre-Sampling  Filters  for  Providing  Adequate  Input  Resolution  and  Filtering 
P ri or  to  Digital  Data  Conversion 

Objective 

The  objective  was  to  determine  the  applicability  of  analog  prefiltering  of 
sensor  outputs. 

Conclusions 


o First  order  analog  prefilters  should  be  used. 

o Use  of  analog  prefilters  dramatically  reduces  sample  rate  required  to  provide 
satisfactory  performance  with  realistic  sensor  noise  and  turbulence. 

o Minor  additional  savings  can  be  obtained  by  using  a control  law  filter  as  a 
pre-filter  where  applicable. 

2.12.2.4  Redundancy  Degradation  with  Time 
Objective 

The  objective  was  to  determine  the  impact  of  time-dependent  failure  modes  on 
reliability  and  on  periodic  testing  requirements.  Expressed  another  way,  what 
failures  cannot  be  detected  by  BIT  and  IFIM? 

Conclusions 

o Undetected  failures  can  have  a significant  impact  on  probability  of  loss  of 
control  as  shown  in  Figures  45,  47,  and  48. 

o BIT  and  IFIM  can  detect  sufficient  failures  to  make  periodic  testing 
unnecessary . 

2.12.2.5  Single  Point  Software  Errors 


Objective 

The  objective  was  to  study  the  feasibility  of  non-identical  programs  in 
redundant  channels  to  preclude  single  point  software  errors. 
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Conclusions 

o Non-identical  software  programs  are  more  costly  than  a single  program. 

o Software  design,  programming  standards,  verification  and  control  procedures 
can  provide  a high  degree  of  confidence  that  no  catastrophic  single-point 
software  errors  exist. 

o A dissimilar  channel,  e.g.,  analog  or  fluidic,  is  preferable  to  non-identical 
software  as  a means  of  compensating  for  single-point  software  errors. 

2.12.2.6  Common  Mode,  Cascaded  and  Propagated  Failures 
Objective 

The  objective  was  to  assess  the  probable  impact  of  single-point  failures  on  a 
fly-by-wire  mechanization. 

Conclus ions 

o Single-point  failures  could  be  a dominant  factor  in  determining  system 
probability  of  loss  of  control  (see  also  Section  2.15). 

o Cross-channel  monitoring  algorithms  must  be  selected  with  care  to  prevent 
cascade-type  failures. 

o Interconnections  between  redundant  channels  should  be  minimized  to  limit 
potential  for  propagated  failures. 

o Extreme  care  must  be  taken  in  the  design  to  minimize  single  point  failure 
probability. 

o System  configurations  with  a large  number  of  voting  planes  increase  the 
potential  for  common  mode  failures.  This  is  one  of  the  reasons  why  it  is 
recommended  that  the  additional  voting  planes  be  limited  to  planes  B and  C 
in  Figure  49  (see  Section  2.12.5)  so  that  data  cross-strapping  is  confined 
to  a single  digital  data  exchange  bus  which  can  be  properly  buffered  and 
monitored. 

o High  failure  detection  capability  is  attainable  by  BIT  and  IFIM.  Maneuvers, 
large  enough  to  enable  detection  of  most  passive-type  sensor  failures,  will 
occur  during  flight.  Stimulation  of  sensors  will  permit  detection  of 
passive-type  failures  during  BIT. 

2.12.2.7  Failure  Detection  for  Two-Fail-Operational  Capability 
Objective 

The  objective  was  to  determine  failure  detection  probabilities  for  the  three 
sound  candidate  configurations. 

Conclusions 

o Essentially  two-fail-op  performance  of  the  redundant  portion  only  can  be 
achieved  on  Configuration  C (4-4-4)  using  cross-channel  monitoring  and 
force-summed  actuators.  No  in-line  monitoring  would  be  used  and  the 
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selection  of  one  of  two  remaining  channels  would  be  accomplished  by  an 
arbitrary  (heads-or-tails)  selection  of  one  of  the  two  remaining  channels 
when  the  3rd  failure  occurs.  The  arbitrary  selection  has  a 0.5  probability 
of  selecting  the  one  good  channel  and  the  probabilities  for  1st,  2nd  and 
3rd  failures  will  be: 

o 1.0  fail-operational; 

o 1.0  fail-operational; 

o 0.5  fail-operational. 

o The  fail-operational  probabilities  of  the  redundant  portions  of  Configura- 
tion A (3-3-3) , with  the  coverage  numbers  given  in  Paragraph  2.12.2.1  above, 
and  using  force-summed  actuators  to  detect  first  failures  and  in-line 
monitoring  techniques  to  detect  second  failures,  will  be: 

o 1.0  fail-operational; 

o 0.944  fail-operational. 

o Configuration  B (4-3-4)  improves  the  fail-op  probabilities  of  Configuration 
A (3-3-3)  only  slightly.  With  perfect  second-fault  coverage  of  the  sensors 
and  actuators  the  probabilities  will  be: 

o 1.0  fail-operational; 

o 0.965  fail-operational. 

o One  hundred  percent  two-fail-op  performance  cannot  be  achieved  using  any 
of  the  configurations  due  to  the  presence  of  non-redundant  components, 
e.g.,  surface  actuators  and  control  surfaces,  and  due  to  the  lack  of 
perfect  coverage.  Therefore,  one  hundred  percent  two  fail-op  should  not 
be  a specification  requirement;  instead,  the  requirements  should  be  speci- 
fied in  terms  of  probability  of  loss  of  control.  The  calculation  of 
probability  of  loss  of  control  should  include  the  entire  system  and  not 
just  the  redundant  portions.  The  calculation  of  probability  of  loss  of 
control  will  require  knowledge  of  the  probability  of  occurrence  for  all 
single  point  failures  as  well  as  coverage  at  each  level  of  redundancy. 

A complete  specification  for  probability  of  loss  of  control  for  a flight 
control  system  could  therefore  be  simply  one  requirement  in  terms  of 
failures  per  10x  hours  for  the  entire  system.  The  probability  of  loss  of 
control  could  also  be  specified  in  terms  of  channel  failure  rate,  coverage 
at  each  level  of  redundancy,  and  single  point  failures. 

For  any  flight  control  system  there  will  be  trade-offs  possible  relative 
to  the  cost  of  improving  channel  failure  rate  vs  the  cost  of  improving 
coverage  vs  the  elimination  of  single  point  failures.  The  specification  of 
both  coverage  and  failure  rate  could  lead  to  not  achieving  the  lowest 
practical  probability  of  loss.  Also,  specifying  both  could  lead  to 
implementing  an  approach  that  is  less  cost-effective  than  is  possible.  For 
the  above  reasons  it  is  recommended  that  the  probability  of  loss  of  control 
be  specified  in  terms  of  one  number  for  the  entire  flight  control  system, 
(i.e.  there  shall  be  no  more  than  y failures  per  10x  flight  hours). 
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2.12.2.8  Fault  Detection  and  Isolation 
Objec t ive 

The  objective  was  to  determine  the  significance  of  in-flight  monitoring  and 
failure  reporting  to  the  level  of  a Line  Replaceable  Unit  (LRU)  or  Weapons 
Replaceable  Assembly  (WRA) . 

Conclusions 


o A high  level  of  coverage  is  essential  to  the  redundant  DFCS,  as  explained  in 
Paragraph  2.12.2.1  above.  Coverage  is  defined  as  the  probability  of  detect- 
ing, isolating,  and  recovering  from  faults.  Consequently,  fault  isolation  to 
the  degree  required  to  achieve  high  coverage  is  essential,  and  includes 
isolating  failed  sensors  and  controllers,  computers,  and  secondary  actuators. 

o Fauj.t  isolation  to  the  LRU  or  WRA  does  not  contribute  to  high  fault  coverage. 

o Fault  isolation  to  the  LRU  or  WRA  in-flight  is  not  cost-effective  in  an  ADP 
and  is  not  recommended. 

° BIT^1"  *S°lat*on  to  t*ie  or  WRA  is  a convenience  in  troubleshooting  during 

2 . 12 . 2 . 9 Nuisance  Disconnects  and  System  Reset 

Objective 

The  two  objectives  of  the  study  were  to: 

1.  Establish  criteria  for  reset  by  the  pilot. 

2.  Establish  criteria  relative  to  nuisance  disconnects. 

Conclusions 

o Analysis  indicates  that  pilot  options  for  resetting  certain  failures  present 
a potential  safety  hazard;  however,  it  is  planned  that  a means  for  resetting 
all  failures  will  be  provided  in  the  ADP.  Further  experience  in  the  ADP  may 
indicate  that  reset  options  should  be  more  restricted  in  an  operational  flv- 
by-wire  system. 

o Nuisance  disconnects  of  an  axis  or  channel,  if  specified,  should  be  in  terms 
of  a maximum  number  of  occurrences  per  flight  hour  not  as  a ratio  of  nuisance 
to  actual  failures.  Tying  nuisance  disconnects  to  actual  failures  implies 
that  a percentage  of  disconnects  shall  be  actual  failures. 
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2.12.2.10  Computer  Instruction  Set  Requirements  for  Compatibility  with  Inputs  from 
Other  Airborne  Digital  Computers 

Objective 

The  object  was  to  determine  the  flight  control  computer  instruction  set 
requirements  for  compatibility  with  inputs  from  other  airborne  digital  computers, 
e.g.,  radar  processing,  displays,  air  data,  weapons  delivery,  and  automatic  landing. 

Conclusions 


o All  inputs  to  the  flight  control  computers  will  be  by  means  of  program 

controlled  input  data  busses  and  direct  memory  access  channels.  These  means 
of  inputting  data  require  no  special  computer  instruction  set  requirements. 

2.12.2.11  Control  System,  Display,  and  Pilot  Management  Interface 
Ob j ective 

The  objective  was  to  identify  the  minimum  interface  required  between  the  pilot 
and  the  redundant  DFCS  to  properly  and  safely  implement  a redundancy  management 
scheme . 

Conclusions 

The  cockpit  controlleis  for  pilot  interlace  are  discussed  in  Section  2.7. 

Specifying  a ratio  of  nuisance  disconnects  to  actual  failures  implies  that  if 
you  design  to  permit  any  nuisance  disconnects  you  must  design  to  cause  actual 
failures. 

2.12.2.12  Actuator  Servo-Electronics  Interface 
Objective 

The  objective  was  to  evaluate  the  actuator  to  servo-electronics  interface  in 
three  different  areas:  (1)  Analog  servo  command  vs  digital,  (2)  Median  select  vs  no 
median  select,  and  (3)  Analog  servo  loop  closure  vs  digital  servo  loop  closure. 

Conclusions 


o Based  on  simplicity  of  hardware  and  reduced  computation  load  requirements, 
the  preferred  configuration  uses: 

o Analog  commands 

o No  median  select  and  no  crossfeed  at  the  secondary  actuator 
o Analog  loop  closure. 

2.12.2.13  Failure  Modes  and  Effects  Analysis 
This  topic  is  discussed  in  Section  2.16. 
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2.12.2.14  Hardware  Dispersal  for  Survivability 
Objective 

The  objective  was  to  define  and  investigate  problems  resulting  from  'he 
dispersal  of  hardware  for  survivability  purposes. 

Conclusions 

o No  reliability  problems  are  associated  with  the  dispersal  of  computers  to 
enhance  survivability,  providing  the  processor  and  its  associated  memory 
are  considered  as  a unit;  i.e.,  located  within  three  feet  of  each  other. 

This  maximum  distance  requirement  is  necessary  to  minimize  memory  faults 
due  to  noise  and/or  delays  in  the  system  logic. 

o Nothing  is  gained  by  separating  the  processor  from  the  memory,  and  the 
preferred  scheme  would  certainly  be  to  package  them  both  within  a single 
LRU.  ' 

o If  crossfeeds  are  required,  a digital  crossfeed  is  preferred  for  hardware 
dispersal  to  reduce  the  interface  wiring  normally  required  for  analog 
cross  feeds. 

o Accelerometers  should  not  be  dispersed  because  of  the  differences  in  accel- 
erations introduced  due  to  different  lever  arm  distances  relative  to  the 
c.g.  Correction  by  computation  may  not  be  practical. 

o Structural  dynamic  differences  for  the  higher  control  frequencies  with  dis- 
persed gyros  and  accelerometers  would  have  to  be  considered. 

2.12.2.15  Module  Fault  Detection  and  Repair  Verification  Through  BIT 

This  topic  is  discussed  in  Section  2.11. 

2.12.2.16  Degree  of  Redundancy  and  Feasibility  of  Detection  and  Isolation  Techniques 
Objective 

The  objective  was  to  determine  the  degree  of  redundancy  and  feasibility  of 
mechanizing  specific  failure  detection  and  isolation  techniques  such  as  in-line 
monitoring  and  cross-channel  comparison. 

Conclusions 

o The  quadruplex  system  requires  high  coverage  on  the  first  and  second  failures, 
the  triplex  requires  high  coverage  on  the  first  failure,  as  shown  in 
Paragraph  2.12.2.1. 

o High  coverage  is  obtained  with  cross-channel-monitoring,  specifically  with 
force-summed  secondary  actuators,  as  explained  in  Paragraph  2.12.2.1  above. 

o Third  fault  coverage  in  a quadruplex  system  need  not  be  better  than  0.5, 
which  can  be  achieved  in  software  with  a simple  "heads  or  tails"  decision. 


90 


o 


Second  fault  coverage  must  be  moderately  high  (on  the  order  of  0.95)  in  a 
riplex  system,  as  shown  in  Paragraph  2.12.2.1  above.  Second  fault  coverage 

and  a^ultors!  m6anS  °f  CempUter  Self-test  and  in-line  monitoring  of  sensors 


o Computer  self-test  is  discussed  in  Section  2.12.8. 
o Sensor  in-line  monitoring  is  discussed  in  Section  2.12.7. 
o Actuator  in-line  monitoring  is  discussed  in  Section  2.12.7. 
’-12-2-17  Computer  Program  Synchronization 
Objective 


The  objective  was  to  determine  methods  for  synchronizing 
The  related  problems  of  inter-computer  data  transfer,  actuator 
and  sensor  processing  requirements  were  considered. 


redundant 

command 


computers . 
divergence, 


Conclusions 


o Frame  synchronization  of  redundant  computers  is  desirable  for  a number  of 
reasons : 


o Near  time  identical  samples  of  redundant  sensor  signals  can  be  taken 
processed,  equalized,  voted,  and  a common  signal  selected  for  use 
subsequent  computations  in  all  computers,  thereby: 

o Minimizing  tracking  errors, 

o Preventing  channel  divergence, 

o Facilitating  the  detection  of  failed  computers,  and 
o Detecting  failed  sensors. 


o 


Output  commands  to  secondary  actuators  can  be  voted  by  selecting 
signal  and  outputting  it  to  redundant  secondary  actuators. 


a common 


o Computer  failures  can  be  detected  in  two  ways 


o By  comparing  commands  and  voting  a difference  which  exceeds  a 
specified  level,  and 


o By  the  timing-out  of  a deadman  timer, 
o Near- simultaneous  mode  selection  can  occur  in  all  computers 


Frame  synchronization  can  be  accomplished  in  basically  two  ways:  through 

e use  of  an  external  clock (s)  that  interrupts  the  computers  at  the  frame 
rate,  or  by  means  of  software  and  a program-loadable  timer. 


o 


An  external  clock(s)  requires  the  minimum 
must  be  mechanized  with  high  reliability, 
would  be  a potential  single  point  failure. 


software.  The  clock(s),  however, 
A single  clock  for  all  computers 


o A method  of  synchronizing  computers  using  software  and  program  loadable 

timers  has  been  devised  based  on  the  following: 

(1)  Each  computer  issues  a synchronization  discrete  to  itself  and  the  other 
two  computers  after  it  has  completed  all  computations  and  the  cycle 
time,  AT,  has  elapsed,  by  its  own  timer.  The  discrete  is  reset  at  the 
end  of  each  computation  cycle. 

(2)  Each  computer  monitors  synchronization  discretes  from  all  computers, 
beginning  at  (AT  - b)  and  ending  at  (AT  + 6),  where  6 is  the  maximum 
expected  difference  between  discretes  (typically  less  than  200  ys  as 
measured  in  the  laboratory). 

(3)  Upon  receiving  any  two  synchronization  discretes,  or  when  the  time 
(AT  + 6)  has  elapsed,  each  computer  will  begin  its  next  computation 
cycle. 

(4)  Once  a computer  does  not  recognize  two  synchronization  discretes  in 
three  successive  computation  cycles,  it  notifies  the  status  panel  of 
its  loss  cf  synchronization  with  the  other  two  computers.  (Loss  of 
synchronization  does  not  alter  computer  operation  as  described  in  the 
previous  steps.) 

(5)  To  protect  the  synchronization  process  from  a discrete  failed  hard  to 
"1",  each  computer  checks  the  status  of  synchronization  discretes  prior 
to  entering  the  synchronization  interval. 

o The  synchronization  process  is  designed  to  incorporate  the  following  features: 

(1)  Each  computer  monitors  its  own  synchronization  with  other  computers. 

(2)  Computer  synchronization  status  is  isolated  from  computer  health  status. 

(3)  Each  computer  continues  to  cycle,  if  it  is  capable,  regardless  of  any 
indicated  failures. 

o Intercomputer  data  transfer,  if  used,  has  two  main  requirements: 

(1)  Large  blocks  of  data  (e.g.,  sensor  data)  should  be  transferred  via 
DMA  channels  to  minimize  the  duty  cycle. 

(2)  The  data  transfer  must  be  mechanized  so  that  a failure  in  the  data 
channel  cannot  cause  the  computers  to  hang  up;  i.e.,  the  data  channel 
must  not  be  a potential  single  point  failure. 

o Actuator  command  divergence  caused  by  integrators  in  the  forward  loop  can  be 

eliminated  in  three  ways: 

(1)  Sensor  inputs  are  exchanged  and  a common  one  selected  for  use  in  all 
channels . 

(2)  Inputs  to  the  integrators  are  exchanged  and  a common  one  selected  for 
use  in  all  channels . 

(3)  Outputs  from  the  integrators  are  exchanged  and  their  inputs  equalized. 
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2.12.2.18  Asynchronous  Computet  Operation 
Ob/jec  tive 


The  objective  was  to  determine  the  advantages  and  disadvantages  of  asynchronous 
computer  operation  vis  a vis  frame  synchronous  operation  (Paragraph  2.12.2.17). 

Conclusions 


o The  advantages  of  asynchronous  operation  are: 

o The  interface  with  sensors  is  simplified. 

o The  need  for  synchronizing  algorithms  or  high-reliability,  external 
clocks  is  eliminated. 

o The  possibility  of  introducing  single  point  failures  is  minimized, 
o The  disadvantages  of  asynchronous  operation  are: 

o Large  time-skews  in  sensor  data  sampling  - approaching  a full  computation 
frame  in  the  worst  case  - can  occur,  requiring  wider  trip  levels  in 
voting  and  monitoring  algorithms,  and  resulting  in  larger  disengage 
transients  and/or  more  nuisance  disengages. 

o Equalization  around  forward-loop  integrators  is  required. 

o The  effect  of  transport  lags  (partially  compensated  for  by  high  sampling 
rates)  is  difficult  to  assess. 

o Different  control  modes  can  exist  in  different  computers  for  at  least 
one  computation  frame. 

2.12.3  FAULT  TOLERANT  FEATURES  OF  SPCS  - It  is  planned  that  the  fault  tolerant 
features  of  the  SFCS  will  be  utilized  by  retaining  the  SFCS  as  a backup  to  the 
Digital  FCS  during  initial  flights  conducted  in  the  ADP. 

2-12.4  DIGITAL  FCS  FAULT  TOLERANCE  POTENTIAL  - The  Digital  FCS  fault  tolerance 
potential  will  be  developed  utilizing  techniques  discussed  in  Sections  2.12.5 
through  2.12.8. 
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2.12.5  ADDITION  UF  VOTING  PLANES  - The  inclusion  of  voting  planes  is  one  of  the  ways 
bv  which  a redundant  flight  control  system  is  made  fault  tolerant.  Theoretically, 
the  more  voting  planes,  the  more  fault  tolerant  the  system.  When  the  system  is  ana- 
log, the  addition  of  voting  planes,  over  and  above  what  are  needed  to  achieve  the 
required  system  reliability,  are  costly  due  to  the  signal  buffering  required  to  pre- 
vent fault  propagation  between  channels  and  the  additional  dedicated  analog  voters. 
With  a digital  computer,  the  buffering  and  cross-channel  data  transfer  are  readily 
facilitated,  and  the  same  software  voting  algorithm  can  be  used  to  vote  on  many 
different  signals.  Consequently,  it  becomes  practical  to  consider  using  many  voting 
planes  to  increase  fault  tolerance  and  improve  system  reliability. 

A study  was  therefore  undertaken  to  determine  the  effect  of  the  number  and 
placement  of  voting  planes  on  system  reliability.  Figure  49  depicts  potential 
voting  plane  locations  for  a typical  DFCS. 


Figure  49 

Potential  Voting  Plane  Locations 


Table  8 summarizes  the  results  of  the  study  and  is  constructed  using  the 
failure  rates  given  in  Table  9.  Table  8,  from  left  to  right,  is  arranged  in  the 
order  of  decreasing  unreliability  (increasing  reliability).  The  parameter  used  to 
measure  unreliability  is  the  probability  of  loss  of  control. 


Table  8 

The  Effect  cf  Voting  Planes  on  DFCS  Unreliability 


Parameter 

Simplex 

Triplex 

Location  of  Voting  Planes 

A 

D 

A&D 

B 

C 

B&C 

ABCD 

Probability 
Of  Loss  of 

1,000,000 

1.0 

0.730 

0.730 

0.514 

0.435 

0.435 

0.156 

0.134 

Control 

X 

X 

X 

X 

X 

X 

X 

X 

X 

(1  Hour 
Mission) 

10~9 

10-9 

10-9 

10-9 

10-9 

10-9 

10“9 

10“9 

10“9 

§ 

I 


'] 
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Table  9 

Failure  Rate  Summary 


Element 

Failure  Rate 
(Per  Operating  Hour) 

Symbol 

MTBF 

(Hr) 

Symbol 

Sensor* 

10  x 10~5 

XS 

10,000 

TS 

A/D  Converters 

15  x 10-5 

XA/D 

6,670 

ta/d 

Compute' 

50x10~5 

xCOM 

2,000 

TcOM 

D'A  Converters 

15  x 10-5 

XD/A 

6,670 

Td/A 

Secondary  Actuators 

10  x 10~5 

XA 

10,000 

ta 

1 x 10  ^ = Total  Channel  Failure  Rate  (X) 

'The  sensors  used  include  a rate  gyro,  pilot  input  transducer,  and  accelerometer,  all  of 
which  are  assumed  essential  for  single  channel  operation.  These  failure  rates  are:  Rate 
Gyro,  Xrq  = 6.5  x 10~^;  pilot  input  tiansducer,  Xpiy  = 1.5  x 10~®;  Accelerometer, 

*ACC  = 2 x 10-5 

The  sensor  failure  rate  is:  Xg  = Xrq  + Xpu  + X/^qq  = 10  x 10~^ 


In  going  from  simplex  to  triplex,  with  a voting  plane  at  E only,  and  assuming 
perfect  coverage^!) , a million  to  one  decrease  in  unreliability  is  attained.  Adding 
four  additional  voting  planes  ABDC  provides  a further  7.5:1  decrease  in  unreliability. 

Conclusion 

The  conclusion  that  results  from  this  study  is  that,  from  a reliability  stand- 
point, there  should  be  a voting  plane  at  E and  a maximum  of  two  additional  voting 
planes  at  B and  C.  Planes  B and  C are  logical  voting  planes  in  the  DFCS  since  the 
signals  at  these  points  are  digital,  can  be  exchanged  over  intercomputer  data 
channels,  and  can  be  voted  with  software  algorithms. 


(1)  Coverage  = probability  of  detecting,  isolating,  and  recovering  from  a fault  or 
failure.  See  Paragraph  2.12.2.1. 
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2.12.6  DATA  REASONABLENESS  - The  term  data  reasonableness  was  used  in  the  Digital 
FCS  Definition  study,  to  describe  a particular  in-line-monitoring  technique  which 
attempts  to  identify  invalid  commands  and/or  responses  by  comparing  the  commands 
and/or  responses  with  estimated  reasonableness  models. 

The  data  reasonableness  analysis  was  conducted  by  identifying  the  parameters 
associated  with  pilot-assist  modes  and  pilot-relief  modes  which  could  be  critical 
to  ground  and/or  flight  safety. 

Having  identified  the  parameters  associated  with  pilot-assist  and  pilot-relief 
modes  which  have  the  highest  potential  for  implementing  safety  by  applying  data 
reasonableness  techniques,  the  maximum,  minimum  and  maximum  rate  of  change  of  these 
parameters  was  estimated.  The  estimates  are  presented  in  Table  10. 


Table  10 

Data  Reasonableness  Parameter  Estimates 


Candidate 

Parameter 

Source 

Value 

Maximum 

Minimum 

Maximum  Rate  of  Change 

Velocity 

1600  mph 

0 

32  ft/sec2 

Altitude 

60,000  ft 

-200  ft 

+1400  ft/ sec. -1400  ft/sec 

Altitude  Rate 

CADC 

INS 

+1400  ft/sec 

—1400  ft/sec 

290  ft/sec2 

Mach 

CADC 

2.2 

0 

0.12/sec 

Pitch  Angle 

INS 

AHhS 

N/A 

(360°  loop 
possible) 

N/A 

(360°  loop 
possible) 

80°/sec 

Bank  Angle 

INS 

AHRS 

N/A 

(360°  roll 
possible) 

N/A 

(360°  roll 
possible) 

300°/sec 

Mass 

(Fuel  flow  only) 

Fuel  System 

12,000  Ib/hr  for  fuel 

Density 

CADC 

HB 

0 

_ ,„_5  slugs/ft3 

6x  10  0 — ” 

MC 

Side  Slip  Angle 

+15° 

-15° 

80°/sec 

ACL  Pitch  Command 

AN/ASW-25A 

+13.5° 

-13.5° 

8°/sec 

ACL  Roll  Command 

AN/ASW  25A 

+14° 

-14° 

15°/sec 

0 

lb/ft2 
200  — — 
sec 

CADC-  Central  air  data  computer  AHRS  - Attitude  ■ heading  reference  system 

INS-  Inertial  navigation  system  I LS  - Instrument  landing  system 

AN/ASW-25A  Digital  data  communications  set 


Additional  data  reasonableness  concepts  were  studied  and  are  in  References  (12) 
and  (22) . 


References:  12.  Digital  Flight  Control  System  Study  Final  Report,  ACS  10,713, 

General  Electric  Co.,  Binghamton,  N.Y.  October  1974. 

22.  Advanced  Fighter  Digital  Flight  Control  System  (DFCS)  Definition 
Study  - Final  Report,  W0728-FR,  Honeywell,  Minneapolis, 
Minnesota.  March  1975. 
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Conclusion 


o It  is  planned  that  the  values  presented  in  Table  10  will  be  stored  in  the 
memory  of  the  flight  control  digital  computers  and  used  to  aid  in  validating 
the  parameters  prior  to  use  in  flight  control  mode  computations.  The  values 
in  the  table  may  require  refinement  during  implementation  in  the  ADP. 

o Consideration  will  also  be  given  to  some  of  the  schemes  presented  in 
References  (12)  and  (22). 

2.12.7  IN-LINE  MONITORING  OT  SENSORS  AND  ACTUATORS  - The  ability  of  the  Digital  FCS 
to  reconfigure  itself  and  continue  undegraded  operation  when  a fault  occurs  in  one 
of  two  remaining  channels  is  implemented  using  in-line  monitoring. 

The  fault  recognition  scheme  applied  during  the  Digital  FCS  Definition  Study  is 
presented  in  Figure  50. 


• Determine  Failure  Modes 

• Determine  Symptoms  Associated  with  the  Failure  Modes 

• Design  Tests  to  Detect  Symptoms 

• Implement  Tests  in  Hardware  or  Software 

Figure  50 

Fault  Recognition  Scheme 


Initial  efforts  relative  to  in-line  monitoring  of  sensors  and  actuators  were 
characterized  by  an  attempt  to  develop  fault  recognition  schemes  which  yielded  100% 
fault  coverage.  This  activity  was  motivated  by  an  attempt  to  achieve  perfect  two- 
fail-operate  performance  using  three  channels.  The  initial  objective  did  not  prove 
to  be  feasible,  as  summarized  below!  however,  adequate  in-line  monitoring  schemes 
were  designed. 

The  analysis  indicated  that  virtually  100%  coverage  of  all  known  failure  modes 
of  Linear  Variable  Differential  Transformers  (LVDT's)  could  be  obtained  by  the  scheme 
illustrated  in  Figure  51.  It  is  planned  that  the  LVDT  monitor  illustrated  will  be 
implemented  by  software  in  the  Digital  Flight  Control  Computer  (DFCC) . 


The  output  of  the  secondary  windings  is  summed  and  compared  with  a reference 
voltage.  During  normal  operation  the  sum  of  the  voltages  is  constant.  The  control 
signal  is  the  difference  between  the  outputs  of  the  two  secondary  windings. 


Figure  51 

Linear  Variable  Differential  Transformer  (LVDT)  Monitor 


The  analysis  indicated  that  97%  of  known  failure  modes  of  the  accelerometers 
installed  in  F-4  S/N  62-12200  could  be  detected  by  two  rather  simple  in-line  detec- 
tion schemes  as  illustrated  in  Table  11.  The  "extended  range"  test  consists  of 
comparing  the  accelerometer  output  (magnitude)  with  a maximum  allowable  value.  t 
is  planned  that  the  accelerometer  extended  range  test  will  be  implemented  by  software 
in  the  DFCC.  The  AC  Voltmeter  Type  Circuit  is  a circuit  which  detects  oscillating 
outputs  with  frequencies  substantially  above  the  control  frequency.  This  circuit  is 
illustrated  in  Figure  52.  Implementation  of  this  test  requires  hardware  to  detect 
the  AC  content  of  the  signal.  The  monitoring  can  be  accomplished  by  software  in  the 
DFCC  and  it  is  planned  that  it  will  be  done  in  this  manner. 

Table  11 

In-Line  Monitoring  of  Accelerometers 


Failure 

Symptoms 

In-Line  Detection 
Scheme 

Oscillator 

Degradation 

Hard  Over  Output 
Voltage 

Extended  Range 

Null  Shift 

High  Null 

None 

Bearing  Friction  or 
Failure  in  Moving  and 
Restoring  System* 

Sticky  or  Ratchety 
Output  Voltage 

None 

Capacitor  Failure 

Output  Oscillates 
at  300  F’z 

AC  Voltmeter  Type 
Circuit 

* I n-F  light  Vibration  Reduces  Probability  that  this  Failure 
will  Occur  In-Flight 


Monitors  97%  of  Known  Failures 


The  AC  component  passes  through  Cl,  is  rectified  and  charges  C2. 
If  the  voltage  across  C2  exceeds  the  predetermined  level 
the  monitor  will  trip. 


Figure  52 

AC  Voltmeter  Type  Circuit 


The  analysis  indicated  that  only  74%  of  the  failure  modes  of  the  SFCS  rate  gyros 
installed  in  F-4  S/N  62-12200  could  be  detected  by  in-line  detection  schemes  as 
illustrated  in  Table  12.  The  extended  range  test  and  AC  Voltmeter  Type  Circuit 
are  equivalent  to  the  tests  discussed  above  for  application  to  accelerometers.  The 
Motor  Current  Monitor  and  Spin  Motor  Rotation  Detector  (SMRD)  tests  are  illustrated 
in  Figures  53  and  54  respectively.  Implementation  of  the  tests  again  requires  both 
hardware  and  software.  It  is  planned  that  the  necessary  hardware  will  be  provided 
in  the  DIF  and  that  the  monitoring  function  will  be  accomplished  by  software  in  the 
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Table  12 

In-Line  Monitoring  of  Rate  Gyros 

Failure 

Symptoms 

In-Line  Detection  Scheme 

No  Start  or  Stop 

High  or  No  Motor  Current 
No  SMRD  Output 

Motor  Current  Monitor 
and  SMRD 

Slow  Start 

Starting  (High)  Current 
Present  Too  Long 

Motor  Current  Monitor 

No  Synchron  zation 

High  Motor  Current,  Low 
SMRD  Output 

Motor  Current  Monitor 

Null  Shift 

High  Null  Voltage 

None 

Failed  Output  Transducer 

No  Output, 
Hardover  Output 

Offset  T ransducer* 
Extended  Range 

High  Starting  Current 

Current  Above  Normal 
During  Start 

Motor  Current  Monitor 

Erratic  Output 

Varying  Output  Voltage 

AC  Voltmeter  Type  Circuit 

Damping  Fluid  Problems 

Change  in  Damping 

Torque  Tests 

Based  on  information  from  Northrop  - sample  base  of  22,000  rate  gyros 
SMRD  - spin  motor  rotation  detector 

•The  SFCS  rate  sensors  would  require  modification  to  provide  offset  transducers  and 
an  additional  3%  of  failures  could  be  detected. 


Monitors  74%  of  Known  Failures 


The  monitor  is  a window  circuit.  If  the  shunt  voltage 
is  within  the  window  it  is  correct. 


Figure  53 

Motor  Current  Monitor 


The  output  pulses  are  amplified  and  will  charge  up  the  capacitor. 
As  the  wheel  slows  down  the  charge  on  the  capacitor  will  decrease 
below  the  monitor  trip  level. 

Figure  54 

Spin  Motor  Rotation  Detector 
(SMRD) 


The  Torque  Test  circuitry,  illustrated  in  Figure  55  is  planned  to  be  used  only 
to  apply  a stimuli  to  the  rate  gyro  during  preflight  BIT. 

The  analysis  indicated  that  99.96%  of  known  secondary  actuator  failures  could 
be  detected  when  two  secondary  actuator  elements  remained.  The  fault  detection 
scheme  is  illustrated  in  Figure  56.  It  is  planned  that  the  monitoring  will  be 
accomplished  by  software  in  the  DFCC's.  The  90-word  algorithm  planned  for  this 
application  is  presented  in  Figure  57. 

Additional  in-line  monitoring  concepts  were  studied  and  are  in  References  (12) 
and  (22)  . 


During  BIT  the  "BIT  enable"  is  applied  to  the  And  gate.  When 
the  gyro  is  to  be  torqued  the  "BIT  gyro  torque  logic"  discrete 
is  applied  to  the  And  gate.  The  And  gate  changes  states  and  turns 
on  transistor  Q1  applying  +28VDC  to  the  rate  gyro  torque  coil. 

Figure  55 

Torque  Test  Circuitry 
(Stimulus  Test) 
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Computer  No.  1 


®c1 


SOC  1 


APi 


Computer  No.  2 


«c2  AP2 


SOC  2 


Secondary 
Actuator  No.  1 


Ui 


Secondary 
Actuator  No.  2 


J To 
(-►  Power 
| Cylinder 

I 


• Force 
Summing 
Bar 


6 = Secondary  Actuator  Position 
Sc  = Secondary  Actuator  Commanded  Position 
AP  = Differential  Pressure 
SOC  = Shut-Off  Command 

Monitors  99.96% 
of  Known  Failures 


Figure  56 

In-Line  Monitoring  of  Secondary  Actuators 


Algorithm  Size  = 90  Words 

‘Preconditions 

1 . Two  actuators  remain 

2.  The  computers  receive  secondary  actuator  position,  6 

3.  The  computers  receive  differential  pressure  signals,  APi  and  AP2 

4.  The  computers  exchange  actuator  commands,  6C^  and  ®C2 


Figure  57 

Algorithm  for  Detecting  which  of  Two  Actuators  Has  Failed 
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Conclusions 


The  analysis  indicates  that  the  fault  coverage  which  can  be  achieved  by  in-line 
monitoring  techniques  varies  from  74  to  over  99  percent  for  the  sensors  and  actuators. 

While  this  coverage  is  not  sufficient  to  provide  100%  "two  fail  operate"  per- 
formance using  three  channels,  the  redundancy  management,  safety  and  reliability 
analyses,  using  the  in-line  monitoring  results  summarized  above,  do  indicate  that 
the  safety  and  reliability  goals  of  the  Digital  FCS  Definition  Study  can  be  achieved. 

2.12.8  DIGITAL  COMPUTER  SELF-TEST 


2.12.8.1  General  - After  one  failure  in  a triplex  system  and  two  failures  in  a 
quadruplex  system,  in-line  monitoring  must  be  used  to  resolve  any  channel  differ- 
ences if  the  DFCS  is  to  continue  to  operate.  When  in-line  monitoring  is  used,  the 
computer  must  first  test  itself;  then  it  is  in  a condition  to  check  other  elements 
of  the  DFCS. 

2.12.8.2  Self-Test  Features  - Self-testing  of  digital  computers  involves  a mix  of 
hardware  and  software.  Certain  basic  portions  of  the  computer  must  be  operable 
before  any  self  testing  can  be  conducted,  e.g.,  power  supplies  and  clocks.  Failure 
of  these  basic  portions  must  be  detected  by  hardware. 

With  these  basic  portions  of  the  computer  operating,  self-testing  of  the 
computer  can  begin.  The  design  of  the  self-test  program  is  based  on  the  inverted 
pyramid  test  philosophy.  That  is,  the  program  first  tests  the  instructions  that 
require  a minimum  of  logic  for  their  execution,  and  the  memory  locations  that  con- 
tain the  self-test  program.  These  verified  instructions  and  memory  locations  are 
then  used  to  test  instructions  and  memory  on  the  next  higher  level.  This  process 
is  continued  until  all  of  the  instructions,  memory,  and  I/O  have  been  verified. 

Studies  conducted  at  MCAIR  have  indicated  that  the  self-test  procedure  should 
include  the  following  features: 

(1)  Hardware  circuitry  will  be  used  to  monitor  the  computer  power  supplies. 
Power  supply  status  signals  will  be  exchanged  between  computers. 

(2)  A high-priority  power  failure  interrupt  will  be  incorporated  to  effect  an 
orderly  computer  shut-down  in  the  event  of  a power  drop-out.  Power-off 
and  power-on  status  signals  will  be  exchanged  between  computers. 

(3)  A deadman  timer  (redundant  if  necessary  to  achieve  required  reliability) 
will  be  incorporated  to  detect  computer  stoppages.  Failure  of  the  soft- 
ware to  reset  the  timer  indicates  a computer  failure.  This  computer  fail 
signal  will  be  sent  to  a status  panel  and  to  the  other  computers. 

(A)  An  interval  timer  will  be  used  to  monitor  the  time  required  to  complete 
various  portions  of  the  self-test  program. 

(5)  Parity  will  be  used  to  continuously  monitor  the  memory  storage  locations. 
When  bad  parity  is  indicated  a.i  interrupt  will  be  initiated. 

(6)  Data,  address,  and  control  lines  will  be  checked  by  reading  out  of  memory 
data  patterns  of  zeros  and  ones,  stored  in  predetermined  locations. 


(7)  Memory-sum  checks  will  be  used  to  check  those  portions  of  memory  containing 

constants  and  instructions.  Since  the  sum  check  requires  more  execution 

time  than  can  be  spared  during  normal  DFCS  operation,  the  sum-check  will 

only  be  used  immediately  following  computer  start-up. 

(8)  The  CPU  will  be  checked  by  means  of  sample  problems,  designed  to  exercise 
the  instructions  used  to  solve  the  control  laws. 

(9)  An  arithmetic  fault  interrupt  will  be  used  to  sense  overflows. 

(10)  I/O  functions  will  be  checked  by  wrapping  the  output  and  input  channels. 

(11)  Parity  will  be  used  to  continuously  monitor  the  transmission  of  data  over 
the  I/O  channels.  When  bad  parity  is  detected,  an  interrupt  will  be 
initiated. 


2.12.8.3  Software  Required  for  Computer  Self-Test  - The  software  required  to  carry 
the  computer  self-test  is  estimated  to  require  1000,  16-bit  words. 


2.12.8.4  Failure  Detection  Probability  of  Computer  Self-Test  - Current  airborne 
computers  are  specified  to  have  a probability  of  detecting  failures  of  0.95.  The 
probability  of  detecting  failures  is  frequently  called  "confidence  factor"  (y) . 
The  manufacturers  of  these  computers  indicate  that  they  can  meet  this  confidence 
factor. 


The  confidence  factor,  y,  is  usually  determined  by  the  formula: 

y = XQ.  -t.-X2 

xtotal  ” x3 


(1) 


where 

Xq  = Failure  rate  of  parts  whose  failure  causes  the  loss  of  the  computer  but 
provides  failure  indication. 

X^  = Failure  rate  of  parts  whose  failure  causes  the  loss  of  the  computer  but 
does  not  provide  failure  indication 

X2  = Failure  rate  of  parts  whose  failure  causes  no  loss  of  the  computer  but  pro- 
vides failure  indication. 

X3  = Failure  rate  of  parts  whose  failure  causes  no  loss  of  the  computer  but 
does  not  provide  failure  indication. 

Xtotal  = Xo  + Xi  + X2  + X3 

Computer  manufacturers  usually  conduct  a Failure  -Mode-and-Ef fects  Analysis 
(FMEA)  to  segregate  the  piece-part  failures  into  the  failure  categories  required 
in  Equation  (1). 

The  confidence  factor  is  usually  limited  to  0.95  by  the  fact  that  portions  of 
the  computer  I/O  cannot  be  checked.  Studies  at  MCAIR  have  indicated  that,  if  I/O 
wrap-around  tests  are  performed  so  that  the  I/O  can  be  checked,  the  confidence 
factor  can  be  raised  to  0.995. 
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Studies  conducted  at  General  Electric  (Reference  (12))  have  concluded  that  a 
typical  airborne  computer  is  likely  to  contain  10,000  to  20,000  single  failure 
modes,  making  an  exhaustive  FMEA  an  insurmountable  task.  Reference  (12)  reports  a 
statistical  approach  that  evaluates  the  confidence  as  to  the  lower  limit  of  y based 
on  the  undetectable  failures  that  are  observed  in  a given  test  sample  size.  It  was 
concluded  that  , values  in  the  range  of  0.90  to  0.95  are  possible. 


Another  approach  to  the  assessment  of  the  probability  of  detecting  failures  is 
believed  to  be  more  applicable  to  the  DFCS.  For  the  DFCS  application,  the  computer 
is  functioning  properly  if  it  is  capable  of  performing  all  necessary  computations 
and  data  transfer  operations.  These  operations  in  a DFCS  application  are  very 
limited  in  number.  The  self-test  hardware  and  software  should  be  designed  to  deter- 
mine whether  the  computer  is  functionally  able  to  perform  these  operations,  and  not 
which  computer  component  may  have  failed.  For  example,  one  of  the  operations  the 
computer  must  perform  is  to  cycle  through  all  the  instructions  in  the  program. 
Failure  to  do  so  means  that  the  computer  has  stopped  (a  high  percentage  of  computer 
failures  are  of  this  type) . This  condition  can  be  easily  detected  with  a watch-dog 
timer.  Note  that  for  DFCS  in-line  monitoring,  it  is  not  necessary  to  know  precisely 
which  failed  part  causes  the  computer  to  stop.  Following  this  line  of  reasoning, 
Equation  (1)  can  be  rewritten  as. 


The  Number  of  Erroneous  DFCS  Operations  That  Can  Be  Detected 


The  Total  Number  of  DFCS  Operations 


In  view  of  the  above,  it  is  believed  that  using  y - 0.95  in  present  reliability 
studies  is  conservative.  A self-test  program  that  incorporates  the  features  itemized 
above,  when  evaluated  by  Equation  (2),  will  yield  a y considerably  higher  than  0.95. 


2.12.8.5  Conclusions  - From  the  analysis  of  computer  self-test,  it  is  concluded 
that : 


o The  confidence  factor,  without  a complete  I/O  test,  is  on  the  order  of  0.95 
when  evaluated  by  Equation  (1); 


o The  confidence  factor,  when  a complete  1/0  wrap  test  is  incorporated,  is  on 
the  order  of  0.995  when  evaluated  by  Equation  (1); 


o The  confidence  factor,  when  evaluated  by  Equation  (1),  is  difficult  to 
calculate  through  a FMEA,  and  even  more  difficult  to  demonstrate  in  the 
laboratory,  because  of  the  large  number  of  piece-part  failure  modes; 


o With  the  self-test  features  of  2.12.8.2,  it  should  be  possible  to  demonstrate 
by  Equation  (2)  a confidence  factor  considerably  greater  than  0.95. 


' ' 


2.13  ANALYS IS  OF  INDUSTRY  EXPERTISE 

During  the  past  several  years  a large  airount  of  general  foreground  research 
in  digital  flight  control  and  display  technology  has  been  accomplished.  A list  of 
more  than  seventy-eight  technical  documents  reporting  both  this  work  and  programs 
currently  in  progress  was  prepared  and  the  documents  were  reviewed  prior  to  and  dur- 
ing the  Digital  FCS  Definition  Study.  The  information  contained  in  the  documents 
was  used,  where  applicable,  in  the  analyses,  simulations  and  ADP  definitions. 

Continuing  contacts  with  the  computer  and  flight  control  industries  have  kept 
MCAIR  informed  of  the  fast  developing  technology  in  digital  flight  control  design. 

Subcontracts  were  placed  with  four  selected  equipment  manufacturers  and  the 
work  done  by  these  subcontractors  is  summarized  in  Figure  58.  See  also  Section  5.0. 

The  work  of  the  above  subcontractors  is  presented  in  References  (12)  1151 

(22),  and  (23).  ’ K 
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General  Electric 

• Digital  Implementation  of  Control  Laws 

• Data  Reasonableness 

• In-Line  Monitoring  of  Sensors  and  Actuators 

• Computer  Reliability.  Redundancy 
and  Self-Test 

• Lab  Demonstration  of  3 Computers 
Operating  Synchronously 

Honeywell 

• Digital  Implementation  of  Control  Laws 

• Data  Reasonableness  Concept  Investigation 

• In-Line  Monitoring  Concept  Investigation 

• Redundancy  and  Reliability 
Concept  Investigation 

• Pilot  - Computer  Communications 

Collins 

• Pilot-Computer  Communications 

• Provide  Area  Nav  and  CDC  for  Simulation 

Lear  Siegler  Incorporated 

• Digital  Computer  Self-Test 

• Redundancy  Management 

• Lab  Demonstration  of  2 Computers 
Operating  Asynchronously 

Figure  58 

Work  Done  by  Four  Selected  Subcontractors 


References:  12.  Digital  Flight  Control  System  Study  Final  Report,  ACS  10,713, 

General  Electric  Co.,  Binghamton,  N.  Y.  October  1974. 


15. 


22. 


23. 


Digital  FCS  Study  Final  Report,  523-0766085-00111M,  Collins  Avionics 
Division,  Rockwell  International,  Cedar  Rapids,  Iowa.  15  Februarv 
1975. 

Advanced  Fighter  Digital  Flight  Control  System  (DFCS)  Definition 
Study  - Final  Report  W0728-FR,  Honeywell,  Minneapolis,  Minnesota. 
March  1975. 

Advanced  Fighter  Digital  Flight  Control  System  Study  - Final 
Report  (Draft)  ADR-789,  Lear  Siegler,  Inc.,  Astronics  Division, 

Santa  Monica,  California.  April  1975. 
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2.14  SOFTWARE  ANALYSIS 

Analyses  have  been  conducted  to  estimate  the  software  requirements  for  the 
candidate  ADP  configurations. 

2.14.1  MULTIMODE  CONTROL  LAWS 

2.14.1.1  Memory  Required  - An  evaluation  of  the  memory  required  for  each  of  the 
control  laws  discussed  in  Section  2.4  is  summarized  in  Table  13. 


Table  13 

Memory  Requirements  for  DFCS  Control  Laws 


Mode 

Memory  (Words) 

Normal  Mode 

1,067 

Lateral  Directional 

426 

Longitudinal 

641 

Air  to  Ground  Gun  Mode^ 

285 

1,141 

Longitudinal 

Lateral  Directional 

856 

Air  to  Ground  Bombing  Moda^ 

Lateral  Directional 

720 

720 

Longitudinal  {Same  as  Norma.  Mode) 

0 

Air  Comba*  Mode^ 

200 

Manual  Carrier  Landing^  * 

Longitudinal 

239 

790 

Lateral  Directional 

267 

Pitch  Rate  Autothrottle 

284 

Automatic  Carrier  Landing^ 

162 

410 

Longitudinel 

Leterel  Directional 

248 

Pitch  Rata  Autothrottle  (Same  as  Manual  Carrier  Mode) 

0 

Pilot  Relief  Modes 

355 

854 

Altitude  and  Pitch  Attitude  Hold 

Heading  and  Roll  Attitude  Hold 

361 

Mech  Hold 

138 

Energy  Management  Control^* 

203 

Departure  Prevention 

528 

593 

Departure  Preventer 

Longitudinel  Pre-Filter 

65 

Fixed  Cenards  (Same  as  Longitudinel  Normal  Mode) 

0 

Total 



5.978 

^Excludes  Complementary  Programs  Performed  in  Display  Computer 


The  Normal  Mode  is  treated  as  the  basic  program;  the  other  modes  are  then 
treated  as  "add-ons".  For  example,  the  Air-to-Ground  Gunnery  Mode  uses  some  of  the 
same  transfer  functions  as  the  Normal  Mode;  consequently,  the  memory  required  for 
the  Air-to-Ground  Gunnery  Mode  includes  only  those  functions  not  already  provided  by 
the  Normal  Mode.  Functions  are  never  duplicated.  For  example,  the  memory  required 
by  the  Automatic  Carrier  Landing  Mode  includes  only  those  functions  not  already 
provided  by  the  Manual  Carrier  Landing  Mode. 

The  memory  requirements  shown  in  Table  13  are  for  the  flight  control  computers 
only,  and  exclude  certain  basic  computations  performed  in  the  display  computer.  The 
air-to-ground  mode  requirements,  for  example, do  not  include  the  solution  of  the 
ballistic  equations,  which  are  solved  in  the  display  computer. 

2.14.1.2  Control  Law  Digitization  - One  widely-used  approach  to  designing^digital 
filters  can  be  classified  as  digitally  simulating  a continuous  (or  "analog")  filter. 
This  approach  uses  a transformation  method  which  transforms  the  continuous  filters 
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that  comprise  the  control  laws  into  difference  equations  which  are  solved  by  the 
digital  tlight  control  computers.  The  resulting  difference  equation  mimics  the  con- 
tinuous filter  in  the  frequency  domain. 

Of  the  man  transformation  techniques,  the  Tustin  Bilinear  Transformation  is 
recommended  since  it  is  easy  to  use  and  understand,  preserves  stability,  allows 
cascading  of  filters,  and  has  the  same  system  order  and  d-c  gain.  The  property  of 
cascading  is  very  important  to  the  digital  implementation  cf  control  laws  that  have 
been  partitioned  into  modular  software. 

The  primary  deficiency  of  the  Tustin  Transformation  is  that  it  does  not 
preserve  the  impulse  response.  For  DFGS  applications,  this  deficiency  manifests 
itself  primarily  in  a shift  in  the  notch  frequency  of  bending-mode  filters.  This 
deficiency  can  be  satisfactorily  overcome  by  prewarping  the  analog  poles  and  zeros. 
The  Tustin  Transformation  is  discussed  in  Reference  (24)  as  well  as  elsewhere  in 
the  literature. 

2-14'1,3  .Pjgggt  Digital  Design  - The  quality  of  a digital  transformation  is  judged 
on  the  ability  to  match  the  analog  filter  without  consideration  of  the  original  per- 
formance specification.  Direct  digital  design  presumably  overcomes  this  restriction 
by  allowing  direct  digital  synthesis  in  either  the  W or  Z planes. 

In  many  practical  applications,  a satisfactory  analog  controller  is  designed  to 
meet  an  original  performance  specification.  In  this  case,  a transformation  technique 
is  appropriate  since  it  is  easier  to  compare  performance  related  to  the  analog  con- 
troller than  to  start  over  with  a direct  digital  design  to  some  original  performance 
specification.  The  original  performance  specification  is  probably  lost  anyway 
through  the  typical  iterations  and  modifications  of  a flight  test  program  which  has 
optimized"  performance. 

The  issue  of  direct"  versus  "transformation"  becomes  somewhat  of  a moot  point 
since  any  Z transfer  function  has  an  analog  counterpart  for  a given  conversion 
technique.  Given  sufficient  understanding  of  the  distortion  produced  by  a particular 
conversion,  proper  adjustments  in  the  analog  form  may  be  made  for  compensation. 

Either  technique  can  provide  a satisfactory  digital  design  with  little  effect  on 
required  computer  resources.  For  higher  frequency  functions,  the  direct  selection 
of  discrete  parameters  results  in  better  performance  in  terms  of  specified  frequency 
response. 

2.14.2  REDUNDANCY  MANAGEMENT  AND/OR  IFIM 

2.14.2.1  Memory  Required  - An  estimate  has  been  made  of  the  memory  required  to 
implement  a redundancy  management  system.  The  redundancy  management  system  consists 
of  a number  of  in-line  monitoring  and  cross-channel  comparison  techniques.  The 
software  routines  that  carry  out  these  techniques  are  termed  Redundancy  Processing. 
The  amount  of  redundancy  processing  required  is  different  for  a triplex  or  quadru- 
plcx  system.  Redundancy  processing  requirements  are  shown  in  Table  14. 


Reference:  24.  Technical  Report  AFFDL-TR-7 3-119,  Volumes  I,  II  & III  "Digital  Flight 

Control  Systems  for  Tactical  Fighters",  Honeywell,  Inc.,  July  1973. 
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Memory  Requirements  for  Redundancy  Management  and/or  IFIM 


Function 

Memory 

T riplex 

Quad 

Signal  Selection  Algorithms 

1450 

2800 

Fault  Recovery  Routine 

200 

200 

Computer  Self-Test  (Includes  Partial  DIF) 

1000 

0 

In-Line  Monitoring  of  Rate  Gyros  and  Accelerometers 

30 

0 

In-Line  Monitoring  of  Secondary  Actuators 

270 

0 

In-Line  Monitoring  of  Single  and  Duplex  Sensors 

300 

300 

Synchronization  Routine 

100 

100 

Subtotal 

3350 

3400 

The  Selection  Algorithms  memory  requirements  shown  in  Table  14  is  based  on  the 
use  of  the  algorithms  to  signal  select  on  14  sensor  inputs  and  11  surface  commands; 
however,  if  sensor  signal  selecting  is  eliminated,  the  signal  selection  memory 
requirement  will  be  reduced  by  56%. 

Following  detection  of  a faulty  channel,  or  a faulty  unit  within  the  channel, 
it  is  necessary  to  reconfigure  the  remaining  good  units  and  channels  so  that  the 
DFCS  can  continue  to  function.  The  Fault  Recovery  Routine  required  to  effect  this 
reconfiguration  is  estimated  to  require  200  words. 

The  computer  self-test  routine,  used  for  in-line  monitoring  in  the  triplex  DFCS 
was  discussed  in  Section  2.12.7.  It  is  estimated  to  require  1000  words.  It  is 
assumed  to  be  required  in  the  triplex  DFCS  only,  since  the  quadruplex  DFCS  achieves 
adequate  reliability  without  in-line  monitoring. 

Reference  (24)  outlines  techniques  for  in-line  monitoring  of  rate  gyros  and 
accelerometers  that  require  6 words  per  unit.  Since  there  are  3 rate  gyros  and 
2 accelerometers  per  channel,  30  words  would  be  required. 

Reference  (24)  outlines  a technique  for  in-line  monitoring  of  hydraulic  secon- 
dary actuators.  The  software  algorithm,  consisting  of  an  actuator  model  (60  words) 
and  equalization  logic  (30  words)  requires  90  words  per  actuator.  It  is  assumed 
that  the  algorithm  can  be  used  as  a subroutine  for  identical  actuators,  e.g.,  the 
left  and  right  ailerons,  but  must  be  repeated  for  different  actuators,  e.g.,  the 
canard  and  stabilator.  If  it  is  then  assumed  that  there  are  three  non-identical 
actuators,  i.e.,  canards,  throttle,  and  all  other  control  surfaces,  270  words  will 
be  required. 

Signals  from  sensor  sources  that  are  typically  less  than  triply  redundant,  e.g., 
CADC's,  INS's,  attitude  gyros,  data  links  and  display  computers,  must  be  treated  on 
an  individual  basis  to  determine  their  validity.  In  some  cases,  validity  discretes 
from  the  signal  source  are  sufficient  to  indicate  the  validity  of  the  signal.  In 
other  cases,  two  identical  or  similar  signals  can  be  compared,  and  if  they  discom- 
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par*3  by  more  than  a certain  amount,  both  signals  can  be  ignored.  In  still  others, 
various  types  of  reasonableness  tests  can  be  used.  The  treatment  of  these  types  of 
signals,  labeled  In-Line  Monitoring  of  Single  and  Duplex  Sensors,  is  estimated  to 
require  300  words.  Thes<~  signals  must  be  monitored  in  the  quadruplex  as  well  as  the 
triplex  DFCS  to  protect  the  gain  schedules  and  outer-loop  commands. 

The  routine  required  to  synchronize  the  computers  is  estimated  to  require 
100  words. 

2.14.3  BIT 


2.14.3.1  Memory  Required  - The  memory  requirement  for  implementation  of  the  pre- 
flight BIT  has  been  estimated.  The  memory  required  to  implement  the  BIT  program 
segments  is  given  in  Table  15. 


Table  15 

Memory  Required  to  Implement  the  BIT  Program  Segments 


Program  Segment 

Memory 

Triplex 

Quadruplex 

Computer  Self-Test 

0* 

1000 

Power  Supply  Tests 

100 

100 

Switch  Tests 

200 

200 

Sensor  Tests 

500 

500 

Actuator  Tests 

200** 

470 

Digital  Interface  Tests 

600 

600 

BIT  Subexecutive 

100 

100 

Display  Routine 

300 

300 

Subtotal 

2000 

3270 

* 1000  Words  of  Computer  Self-Test  are  Used  for  Second  Fault  Redundancy 

Management  and  arc  therefore  Accounted  for. 

* ' 270  Words  of  Actuator  Tests  are  Used  for  Second  Fault  Redundancy 

Management  and  are  therefore  Accounted  for. 


The  memory  required  to  implement  computer  self-test,  used  for  in-line  monitoring 
in  a triplex  system,  is  1000  words.  Since  the  self-test  routine  used  in  BIT  is 
essentially  the  same  as  that  used  for  in-line  monitoring  in  the  triplex  system,  the 
memory  required  has  already  been  accounted  for  in  the  case  of  the  triplex  system. 

The  power  supply  tests  are  estimated  to  require  100  words. 

The  switch  tests  are  estimated  to  require  200  words.  The  switch  tests  may 
require  some  portions  of  the  mode  switching  logic  (2400  words  total),  but  this 
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The  actuator  tests  are  estimated  to  require  270  words  of  memory  (used  for  in- 
line monitoring  in  a triplex  system)  plus  an  additional  200  words  to  test  the 
actuator  isolation  devices  at  different  redundancy  levels.  These  additional  tests 
will  cause  a force  fight  at  the  secondary  actuators,  simulating  an  actuator  failure 
or  channel  fault,  thereby  testing  the  ability  of  the  device  to  isolate  a fault. 

The  270  words  has  already  been  accounted  for  in  the  case  of  the  triplex  system. 

The  Digital  Interface  Unit  (DIF)  is  estimated  to  require  600  words.  The  memory 
required  for  this  unit  depends  on  the  level  of  fault  isolation  required.  The  600 
words  assumes  fault  isolation  to  a function. 


The  BIT  subexecutive,  which  controls  and  links  the  various  program  segments  is 
estimated  to  require  100  words. 

The  Display  Routine,  which  formats  the  various  messages  on  the  CDC,  is  estimated 
to  require  300  words. 

2.14.4  MUX  - The  MUX  system,  discussed  in  Section  3.2.7,  has  no  impact  on  the  flight 
control  computer. 

2.14.5  EXECUTIVE 


2"14'5-1  Memory  Required  - The  memory  required  to  implement  the  executive  functions 
of  the  flight  control  computers  is  summarized  in  Table  16. 

Program  initialization  estimated  requirements  are  shown  in  Table  17.  The 
memory  sum  test  would  not  be  required  in  a quadruplex  system. 


Table  16 

Executive  Memory  Requirements 


Function 

Memory 

Triplex 

Quadruplex 

Program  Initialization 

450 

300 

Interrupt  Processing 

620 

620 

Program  Scheduling 

100 

100 

Input/Output  Processing 

420 

420 

Mode  Switching  Logic 

2400 

2400 

Total  Executive 

3990 

3840 

Table  17 

Program  Initialization 


Memory 

Triplex 

Quad 

Variable  Initialization 

300 

300 

Memory  Sum  Test 

150 

- 

Subtotal 

450 

300 

2 * 14,5 • 2 Interrupt  Processing  - The  function  of  interrupt  processing  is  to  service 
all  internal  and  external  priority  interrupts.  Table  18  breaks  down  the  memory 
requirement  by  interrupt  processing  function. 

2,14‘5-3  Program  Scheduling  - Program  scheduling  involves  scheduling  the  modules  in 
the  proper  time  sequence  and  the  background  programs  on  a computer- available  basis. 
The  program  scheduling  function  is  estimated  to  require  100  words. 
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Table  18 

Interrupt  Processing 


Function 

Memory 

Quad  and  Triplex 

Power  Fail  Interrupt 

50 

Write  Protect  Interrupt 

70 

Memory  Parity  Error  Interrupt 

60 

I/O  Channel  Parity  Error  Interrupt 

70 

Arithmetic  Fault  Interrupt 

50 

Oeadman  Timer  Interrupt 

10 

Internal  Timer  Interrupt 

40 

External  Spare  Interrupt 

50 

Computer  Control  Panel  Interrupt 

20 

End-of- Frame  Processing 

100 

DMA  Transfer  Complete  Processing 

100 

Subtotal 

620 

2.14.5.4  Input/Output  Processing  - Input/Output  processing  estimated  requirements 
are  shown  in  Table  19.  The  Control  Panel  Processing  function  handles  the  packing, 
unpacking,  coding,  and  decoding  associated  with  reading  data  into  and  out  of  the 
control  computer  via  a control  panel.  The  Sensor  Data  Preprocessing  function  in- 
cludes the  digital  data  processing  that  precedes  signal  selection,  and  includes, 
for  example,  removing  sensor  reference  voltage  variations.  The  DMA  channel  control 
routine  initiates  and  terminates  data  flow  over  the  DMA  channel. 


Table  19 

Input/Output  Processing 


Function 

Memory 

Quad  and  Triplex 

Control  Panel  Processing 

200 

Sensor  Data  Reprocessing 

200 

DMA  Channel  Control 

20 

Subtotal 

420 

2.14.5.5  Mode  Switching  Logic  - Reference  (24)  gives  the  memory  required  to  imple- 
ment the  engage  logic  for  a SAS,  CAS,  and  Autopilot  control  system.  The  autopilot 
discussed  in  Reference  (24)  has  only  an  attitude  hold  mode.  The  engage  logic, 
including  priority  logic,  faders,  and  synchronizers,  requires  approximately  600 
words.  The  multimodes  of  the  DFCS  are  estimated  to  require  four  times  this  number 
or  2400  words.  Obviously,  the  estimate  is  heavily  dependent  on  the  actual  number 
of  modes  implemented  in  the  ADP. 


2.14.6  TOTAL  FLIGHT  CONTROL  MEMORY  - The  total  memory  estimates  for  the  Triplex  and 
Quadruplex  Flight  Control  Computers  presented  in  Sections  2.14.1  through  2.14.5  are 
summarized  in  Table  20. 
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Table  20 

Total  Memory  Required  for  Flight  Control  Computers 


Category 

Memory 

Triplex 

Quadruplex 

Control  Laws 

6,000 

6,000 

BIT 

2,000 

3,270 

Redundancy  Management  and/or  IFIM 

3,350 

3,400 

Executive 

3,990 

3,840 

Total 

15,340 

16,510 

2.14.7  DISPLAYS  AND  CONTROLLERS  - MEMORY  REQUIRED  - The  displays  and  controllers 
configuration  to  Implement  the  DFCS  ADP  is  given  in  Section  4.4.  The  block  diagram 
(Figure  96,  Section  4.4)  includes  a display  computer  and  a flight  management  com- 
puter. The  memory  required  for  the  Display  Computer,  but  not  the  Flight  Management 
Computer,  is  given  in  Table  21. 


Table  21 

Memory  Requirements  for  Display  Computer 


Module 

Memory 
Words!  16  Bits) 

Executive 

840 

Data  Base 

2,600 

Subroutines 

740 

Self-Test 

820 

Navigation 

2,960 

Air-to-Ground 

2,630 

Air-to-Air 

3.660 

Flight  Director 

590 

Controls  and  Displays 

2,340 

Radar  Target  Generation 

7,000 

Total 

24,180 
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2.15  SINGLE-POINT-FAILURE  ANALYSIS 


2.15.1  GENERAL  - A single-point- failure  analysis  was  performed  during  the  early 
stages  of  the  Digital  FCS  configuration  selection.  The  purpose  of  this  analysis 
was  to  influence  configuration  selection  and  design  by  identifying  single-point 
failures  which  could  result  in  a catastrophic  condition.  For  the  analysis,  the 
candidate  configurations  were  divided  into  five  functional  areas.  These  areas 
included  (1)  sensor  inputs,  (2)  pilot  controller  inputs,  (3)  primary  and  secondary 
actuators,  (4)  flight  crew  displays,  and  (5)  computational  schemes.  The  analysis 
results  as  related  to  each  functional  area  are  summarized  in  the  following  paragraphs. 

2.15.2  SENSOR  INPUTS  - Considered  during  the  analysis  were  rate  sensors,  accelerom- 
eters, and  dynamic  pressure  sensors.  A potentially  catastrophic  single-point-failure 
associated  with  the  rate  sensor  and  accelerometer  packages  was  identified;  a loose  or 
broken  mounting  provision  would  cause  multiple  erroneous  and/or  erratic  outputs  from 
the  affected  sensor  package.  These  signals  would  generate  uncommanded  pitch,  roll, 
or  yaw  excursions,  and  depending  upon  the  flight  conditions  and  characteristics  of 
the  inputs,  possible  loss  of  aircraft  control  could  occur.  To  reduce  the  criticality 
of  these  single— point— failures,  a safety  switch  could  be  added  to  the  base  of  each 
gyro  and  accelerometer  package  to  detect  any  condition  where  the  package  becomes 
loose  or  disconnected  from  the  airframe.  The  switch  would  activate  logic  within  the 
DFCS  which  will  disregard  the  false  or  spurious  signals  and  select  alternate  control 
laws.  This  results  in  the  elimination  of  all  single-point  critical  and  catastrophic 
conditions  associated  with  sensor  component  mounting. 


The  prime  function  of  the  dynamic  pressure  sensor  packages  (dual  units  in 
parallel)  is  to  provide  inputs  for  automatic  gain  scheduling.  There  are  several 
single-points-of-failure  which  could  cause  the  sensor  inputs  to  be  erroneous  and 
result  in  incorrect  gain  scheduling.  Examples  include  a cracked,  broken,  or  plugged 
pitot  or  static  line,  or  a cracked  bellows  on  one  sensor  unit.  The  criticality  of 
these  failures  would  be  largely  dependent  upon  flight  conditions  at  the  time  of  the 
failure  and  pilot  awareness  of  erroneous  scheduling.  To  resolve  this  problem,  a 
data  reasonableness  test  will  be  used  to  detect  the  failure.  The  pilot  will  then 
be  alerted  to  the  automatic  gain  scheduling  problem  and  have  the  capability  to 
select  the  gains  manually. 

2.15.3  PILOT  CONTROLLER  INPUTS  - The  primary  flight  controllers  include  the  side 
stick  controller,  rudder  pedal  assembly,  and  throttle  controller.  These  provide  for 
the  control  of  pitch,  roll,  yaw,  direct  lift,  direct  side  force,  engine  thrust,  and 
the  selection  of  certain  flight  modes.  The  analysis  of  these  controllers  identified 
a potential  single-point-failure  associated  with  the  rudder  pedal  assembly.  If  the 
pedal  support  is  jammed  or  disconnected,  or  the  pedal  transducer  attach  point  or 
feel  cylinder  is  disconnected,  the  yaw  command  inputs  would  be  fixed.  Continued 
aircraft  control  would  then  be  dependent  upon  flight  conditions  and  rudder  surface 
deflection  at  the  time  of  the  failure. 

2.15.4  PRIMARY  AND  SECONDARY  ACTUATORS  - All  longitudinal,  lateral,  and  directional 
primary  and  secondary  actuators  were  considered  during  the  analysis.  Several  fail- 
ures were  identified  which  would  result  in  the  complete  loss  of  actuator  function, 
i.e.,  loss  of  control  of  the  affected  surface.  These  failures  were  categorized 
either  as  total  actuator  motion  stopped,  e.g.,  piston  seizure  or  jam,  or  loss  of 
actuator  output,  e.g.,  summing  shaft  or  rod  end  broken.  In  the  case  of  the  stabil— 
ator  and  rudder  primary  and  secondary  actuators  and  the  canard  actuators,  some  of 
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2vSoff^1UreS  CHUld  resultc±n  catastrophic  conditions.  Reduction  in  the  critical- 
ity of  the  canard  actuator  failures  could  be  accomplished  in  one  of  two  ways: 


U)  The  actuator  stroke  might  be  mechanically  or  hydraulically  limited  to 
produce  +15  canard  surface  travel.  This  results  in  elimination  of  one 
catastrophic  condition.  The  actuator  rod  end  failure  remains  a potential 
catastrophic  situation. 


(b)  Mechanical  stops  might  be  incorporated  to  physically  limit  canard  surface 
motion  to  +15  . This  eliminates  all  identified  catastrophic  conditions 
associated  with  the  canard  actuator. 


?'j5'oC  ypHT  CREW  DISPLAYS  - The  flight  crew  displays  including  the  HUD,  MFD's, 
and  CDC  readouts  were  reviewed  to  determine  the  criticality  of  a complete  loss  of 
unction  on  each  display.  No  significant  single-point- failures  were  identified. 


COMP^TATIONAL  SCHEMES  - The  primary  source  of  angle-of-attack  (a)  and 
sideslip  angle  (6)  signals  for  the  Digital  FCS  control  laws  will  be  the  a and  6 
estimators.  The  estimators  will  be  mechanized  in  each  flight  control  compeer  and 
depend  upon  data  inputs  from  other  aircraft  sources.  Since  these  estimators  are 
redundant  the  only  single  failures  which  could  cause  erroneous  signals  from  all  a 
and  S estimators  would  be  failures  associated  with  these  data  input^,  e.g.,  velocity 
Mach  number  and  dynamic  pressure.  It  has  been  determined  that  a and  S input  sSls 
and/orVr  f ^ ^ caPabi^y.  However,  allowing  Lorrec? T 

ro  (h  H Y COntro1  laws  would  affect  performance,  and  control  problems 

could  develop  in  some  instances.  The  most  critical  area  affected  would  be  the 

departure  prevention  logic.  If  the  pilot  is  relying  on  this  logic  and  the  function 
is  in  error,  inadvertent  aircraft  departure  could  occur.  To  correct  this  situation 
the  estimator  schemes  will  employ  a failure  detection  technique  which  uses  a anS  8 
probe  inPuts.  The  probe  inputs  will  be  electrically  dual  from  each  of  the  two  a 
sensors  and  the  single  P sensor.  When  the  detection  scheme  declares  the  estimators 
alerted"  err°r’  ***  departUre  Prevention  logic  will  be  disabled  and  the  pilot 


follows .C0NCLUSI0NS  ~ The  conclusions  from  the  single-point-failure  analysis  are  as 


The  single-point-failures  identified  during  the  analysis  were 
common  to  all  candidate  Digital  FCS  configurations. 


A criticality  ranking  by  aircraft  axis  shows  the  longitudinal  axis  to  be 
the  most  critical,  and  is  followed  by  the  directional  axis.  No  catastrophic 
single- point- failures  were  identified  in  the  lateral  axis. 
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2.16  SAFETY  ANALYSIS 

2.16.1  GENERAL  - A safety  analysis, which  included  a Failure-Mode-and-Effect  Analysis 
(FMEA),  has  been  conducted  on  the  three  sound  candidate  Digital  FCS  configurations  to 
provide  a risk  comparison  of  the  configurations  and  to  identify  the  safety-critical 
components.  These  components  were  those  where  single-point-failures  would  result  in 
Class  IV  Catastrophic  or  Class  III  Critical  Hazards.  These  hazards  are  defined  as 
follows : 

o Class  IV  Catastrophic  - Hazards  that  will  cause  death  or  loss  of  the  aircraft 
and  for  which  there  is  no  time  for  corrective  action. 

o Class  III  Critical  - Hazards  that  will  cause  serious  personnel  injury  or 
major  system  damage,  or  will  require  immediate  corrective  action  to  prevent 
death  or  loss  of  the  aircraft. 

2.16.2  FMEA  RESULTS  - For  the  potential  single-point- failure  hazards  which  were 
identified,  the  following  were  determined: 

o LRU  or  WRA  involved, 
o Analog  or  digital  FCS, 
o Failure  mode, 
o Cause, 

o Failure  effect, 
o Hazard  classification,  and 
o Probability  of  occurrence. 

Potential  Class  IV  hazards,  assuming  provisions  discussed  in  Section  2.15  were 
implemented,  are  summarized  in  Table  22.  A comparison  is  also  made  to  the  PACT 
configuration. 

Table  22 

Failure-Mode-and-Effect  Analysis  Summary  of  Results 


Clan  IS 


Clan  in  or  IS 
Hazards^) 
(m) 


Configuration 

Digital  FCS  (Conf  A,  B,  or  C) 
with  Analog  Backup 

Digital  FCS  (Conf  A.  B,  or  C) 
Without  Analog  Backup 

SFCS  with  Canards 
(PACT  Configuration) 


Ppj2  = Probability  of  a Class  El  Hazard 

PFffi  ",  £ ^ ♦<»,?,  <PFm0rPFl2>j 

n “ Number  of  Possible  Class  IS  Hazards 

m = Number  of  Ponible  Class  HI  or  IS  Hazards 

(1 ) = Class  IS  Only  at  high  q and/or  Landing  or  Takeoff 


Total 

pFnr 

x (10)— 7 


...a 
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2,16:;L  ADDITIONAL  SAFETY  STUDIES  - Additional  safety  studies  were 

ground  and/o^fll  V ***  Digital  FCS  configurations  which  could  be 
ground  and/or  flight  safety.  These  were: 


conducted  of 
critical  to 


o Outer  loop  inputs, 
o Normal  Mode  select  circuitry,  and 
o Mode-select  and  display  interface. 


whJch^L  ~ t-er^°°PJI!)PUl:S  " Table  23  contalns  a list  of  the  outer  loop  inputs 

T considered  during  this  study  and  the  respective  functions  which  utilize 

cions  Sa£cty  i-P“£  r'1«'d  '»  “<*  »'  lone- 


Table  23 

Digital  FCS  Outer  Loop  Inputs 


Outer  Loop  Input 

Function 

Gain 

Scheduling 

or  and  P 
Estimation 

Gravity 

Correction 

Used  for 

Velocity  (V) 

X 

X 

X 

Mach  Hold 

Altitude  (h) 

Altitude  Hold  and 

Energy  Management 

Dynamic  Pressure  q 

X 

Normal  Mode 

Altitude  Rate  (h) 

Altitude  Hold  and 

Energy  Management 

Mach  Number  (M) 

X 

X 

Mach  Hold  and 

Energy  Management 

Pitch  Angle  (0) 

X 

Attitude  Hold,  ACL, 

Energy  Management 

Bank  Angle  (p) 

X 

Attitude  Hold,  ACL 

Mass  (m) 

X 

Density  (p) 

X 

An^e-of  Attack  (a) 

X 

X 

Sideslip  Angle  (0) 

X 

Data  Link-Control 

Commands 

ACL 

ILS- Control 

Commands 

Automatic  ILS 

Note:  X • Indicates  Outer  Loop  Input  Required 


O Gain  Scheduling  -_Dynamic  pressure  (q)  , Velocity  (V),  and  Mach  number  (M) 

wVi6  q sensors  are  used  extensively  in  the  various  control  laws 
g n scheduling  parameters.  Two  q sensors  receive  pitot  and  static 
pressure  inputs  from  the  pitot-static  system.  Each  sensor  package  contains 
l1-8  Wh^h  “““res  the  difference  of  these  two  pressures  and  mechanic- 
ally drives  the  wipers  of  two  potentiometers.  This  results  in  two  electrical 

0U£PatifignalS  fr°m  eaCh  SenS°r  Packa8e  which  are  used  for  automatic  gain 
scheduling.  A failure  of  one  of  these  four  electrical  outputs  can  be* 
readily  detected  using  comparison  techniques  and  the  failed  signal  removed. 
Failures  upstream  of  the  q sensors;  in  the  pitot-static  system,  could  cause 
erroneous  electrical  outputs  from  all  four  potentiometers.  It  is  planned  thal 
a velocity  signal  from  an  independent  source  such  as  the  INS  will  be  utilized 
for  comparison  with  the  velocity  output  of  the  5 sensors  to  enable  detection 
of  this  type  of  failure.  A significant  deviation  among  these  signals  could 

the  pilotmP  ^ t0  aUt0n,atically  select  a discrete  safe  gain  and/or  notify 
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O ot  and  B Estimation  - A failure  or  malfunction  of  one  or  more  of  the  sensing 
elements  associated  with  velocity  (V) , Mach  number  (M) , mass  (m) , and 
density  (p)  would  cause  erroneous  a and  3 estimations.  The  safety  critical- 
ity of  this  condition  and  the  method  of  control  have  been  previously  dis- 
cussed in  Section  2.15.6. 

o Gravity  Correction  - Failure  or  malfunctions  causing  the  loss  of  the  gravity 
correction  feedback  term  are  not  considered  to  be  safety  critical. 

° Pilot-Relief  Modes  - The  capability  to  immediately  revert  to  the  Normal 
Mode  will  effectively  control  the  criticality  of  failures  causing  the  loss 
of  any  or  all  pilot-relief  modes. 

2 ’ 16 • 3,2  Normal  Mode-Select  Circuitry  - Due  to  the  wide  range  of  capabilities 
provided  by  the  Normal  Mode  including  a return  and  land  capability,  the  mode-select 
circuitry  must  provide  a high  probability  that  the  mode  will  be  engaged  when  com- 
manded by  the  pilot.  In  order  to  investigate  the  options  available,  a study  was 
performed  to  define  and  evaluate  several  mode-select  configurations.  To  provide 
high  reliability,  three  means  of  selection  of  the  Normal  Mode,  with  switches  on  the 
side  stick  controller  (SSC) , on  the  CDC,  and  an  additional  Normal  Mode  switch,  was 
chosen  as  the  desirable  configuration  as  shown  in  Figure  59. 


'Additional  Normal  Mode  switch 


Figure  59 

Normal  Mode  Select  Configuration 

2.16.3.3  Mode-Select  and  Display  Interface  - A study  was  performed  on  the  equipment 
and  associated  interfacing  functions  required  for  the  Digital  FCS  mode  selection, 
display  selection,  and  display  readout  capabilities.  The  purpose  of  this  analysis 
was  to  identify  safety  considerations  for  use  in  the  interface  design.  The  safety 
considerations  identified  by  this  study  include! 

o All  pilot-assist  mode  select  signals  from  the  CDC,  the  throttle  levers,  or 
the  SSC  should  be  separated  into  two  functional  paths.  One  path  should 
address  the  display  and/or  flight  management  computer,  and  the  other  path 
should  address  the  flight  control  computers. 


118 


o 


Failure  and  fault  information  which 
dures,  and  FCS  operational  status, 
display  priority. 


is  critical  to  flight,  emergency  proce- 
if  requested  by  the  pilot,  should  have 


o Failure  and  fault  reset  capabilities  should  receive  careful  attention. 


2.16.4  CONCLUSIONS  - The  conclusions  of  the  safety  analysis  are  as  follows: 

o The  FMEA  identified  the  safety-critical  components. 

° thrK\?1i?ital  FCS  configurati°ns  are  identical  with  respect  to  the  numbei 

and  probability  of  occurrence  of  Class  IV  hazards. 

o Utilizing  an  analog  backup  during  the  initial  portion  of  the  flight  test 
failure.  Slgnif: lcantly  ™>dify  the  probability  of  a catastrophic 

° fsivniH^  "°,ClaSS  IV  hazards.  the  Digital  FCS  configurations  demonstrated 
a significant  improvement  over  the  PACT  configuration. 

o The  criticality  of  all  failures  associated  with  the  outer  loop  inputs  has 
been  reduced  or  controlled  to  an  acceptable  level  of  safety. 

o The  Normal  Mode  select  configuration  chosen  for  design  provides  a hivh 
probability  that  the  mode  will  be  engaged  when  to^Hy  the  pilot 

O Implementation  of  the  safety  considerations  provided  for  the  design  of  the 
mode-select  and  display  interface  should  result  in  the  elimination  of 
safety-critical  failures. 
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2-17  reliability  analysts 


Thefthree  Sound  candidate  configurations  were  analyzed  for  the 
P bability  of  loss  of  control  from  cumulative  failures  in  the  DFCS  control  paths 
for  comparison  with  the  Statement  of  Work  reliability  goal  of  no  more  t^n  two 
ca  astrophic  failures  Per  106  flight  hours  (displays  weie  excluded  from  the  analysis') 
The  results  obtained  are  presented  in  Figure  60.  The  probabilitiL  show  are  fofthe' 
redundant  command  paths  through  and  including  the  redundant  portions  of  the  secondary 

TnZTl'  % ^diCate,d  °n  Fi8ure  6°.  ^e  stabilator  actuator  and  associated TiZaZl 
°n  ° 3 the  configurations,  were  excluded  from  the  chart  and  the  specification 
was  correspondingly  reduced  to  one  failure  per  10^  flight  hours. 
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Probability  of  Loss  of  Control  - (Failures/Flight  Hours) 

DFCS  configurations  include  expected  coverage 
Stabilator  actuator  failure  rate  is  1.0  x 10-6  faj lures 
per  flight  hour  as  derived  from  AFM  66  1 data  and  is 
not  included  in  the  probabilities  shown 
Excludes  electrical  and  hydraulic  power  supplies 

Figure  60 

Reliability  Comparison 

Co„fl^raM™t'B"COVTr8e  “ eaCh  °f  Configuration  "A"  and 

Configuration  B . The  expected  coverage  reflects  the  fact  that  currently-planned 

in-ime  monitoring  will  not  be  able  to  detect  all  failures  of  the  monitored  eouio- 

ment.  e expected  coverages  used  in  this  analysis  are  presented  in  Table  24. 


Table  24 

Expected  Coverages 


Component 

Expected  Coverage  (Percent) 

Pilot  Input  Sensors 

99.9 

Rate  Gyros 

74.0 

Normal  Accelerometers 

97.0 

1/2  DIF  (Input) 

99.5 

Computer-Computer  Interface 

99.5 

Digital  Computer 

99.5 

1/2  DIF  (Output) 

99.5 

Power  Supply-Servo  Amp 

99.9 

Secondary  Actuator  Element 

99.9 

120 


,w‘..  . £ 


:_v-prr 


SPJW*':'  Ml 


All  three  axes  were  considered  in  setting  up  the  original  reliability  equations 
from  which  the  data  presented  in  Figure  60  were  derived.  However,  a basic  ground 
rule  was  that  the  F-4  could  be  landed  on  a runway  with  pitch  control  and  either  roll 
or  yaw  control.  The  "or"  provision  with  respect  to  roll  and  yaw  places  these  two 
axes  in  parallel  making  the  combined  total  for  the  two  axes  so  small  that  the  roll- 
yaw  failure  prolabilities  drop  out  in  the  round-off  when  roll-yaw  is  combined  with 
the  failure  probabilities  for  the  pitch  axis.  As  a practical  matter,  therefore,  the 
values  derived  are  those  for  the  critical  pitch  axis. 

2.17.2  CONCLUSIONS  - Any  of  the  three  sound  candidate  configurations  can  provide 
adequate  reliability  to  meet  the  Statement  of  Work  requirement  if  the  expected 
coverage  is  obtained.  Reliability  degradation  which  can  be  expected  with  reduced 
coverage  is  presented  in  Section  2.12. 


2 . 18  MAINTAINABILITY  ANALYSIS 

■^•28.1  GENERAL  - ihe  three  sound  candidate  DFCS  configurations  were  analyzed  to 
determine  the  estimated  maintainability  parameters  necessary  to  support  the  Digital 
Flight  Control  System  (displays  were  excluded  from  the  analysis).  The  objective  of 
this  analysis  was  to  provide  a realistic  basis  for  determining  the  relative  support 
resources  and  logistics  costs  for  each  configuration. 

The  repair  times  for  the  installed  system  on  the  aircraft,  and  the  LRU's  in  the 
shop,  are  based  generally  on  the  maintenance  concept  indicated  in  Figure  61  "Digital 
FCS  Maintenance  Flow".  This  concept  is  predicated  on  a design  which  provides  for  a 
built-in  test  capability  and  minimizes  the  need  for  any  external  organizational 
level  AGE  except  for  electrical  and  hydraulic  power  carts.  Detected  faults  will  be 
isolated  to  the  faulty  LRU  which  is  then  removed  and  replaced  with  a serviceable 
spare.  Built-in  test  is  also  utilized  to  verify  the  system  repair. 


Figure  61 

Digital  FSC  Maintenance  Flow 


The  intermediate  level  repair  times  are  predicated  on  a packaging  design  which 
permits  direct  rapid  access  to  modular  plug-in  subassemblies,  and  includes 
sufficient  test  points  brought  out  to  external  test  connectors  capable  of  interfac- 
ing with  automatic  computer  controlled  test  stations  capable  of  effecting  isolation 
to  a faulty  plug-in  module  subassembly.  The  repair  times  and  the  maintenance  action 
rates  for  comparable  LRU's  having  similar  capabilities  were  obtained.  These  param- 
eters were  used  to  modify  the  appropriate  reliability  and  maintainability  quantities 
which  were  applicable  to  each  Digital  FCS  LRU. 
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2.18.2  MAINTENANCE  TASK  ANALYSES 


Unscheduled  Maintenance  - Maintenance  Task  Analyses  were  performed  for 
each  of  the  three  sound  candidate  DFCS  configurations.  Unscheduled 
Maintenance  Manhours  per  Operate  Hour  (MMH/OH)  was  calculated  for  each 
LRU  in  each  configuration  to  obtain  the  totals  for  each  configuration. 
The  Maintenance  Action  Rates  (p)  and  Mean  Maintenance  Manhours  to 
Repair  (MMTR)  were  calculated  for  Organizational  level  (on  aircraft) 
and  Intermediate  level  (shop)  maintenance.  Table  25  summarizes  the 
maintenance  manhours  and  Table  26  summarizes  the  maintainability 
parameters  for  each  configuration. 


Table  25 

Maintenance  Manhour  Comparison  Summary 


Organizational 

Level 

MMH/OH 

Intermediate 

Level 

MMH/OH 

Total 

MMH/OH 

Total*1* 

MMH/FH 

0.056 

0.032 

0.087 

0.262 

0.061 

0.038 

0.099 

0.298 

0.063 

0.040 

0.103 

0.309 

Configuration  A 0.056  0.032 

Configuration  B 0.061  0.031 

Configuration  C 0.063  0.04( 

(1)  Assumes  3 operating  hours  pei  flight  hour. 


Table  26 

Maintenance  Parameter  Summary' 
Organizational  Level 


Intermediate  Level 


Quantity 
of  LRU’s 

MOH*1* 
x 106 

mtbma*2* 

MMTR*31 

POH(1) 
x 106 

MTBMA*2* 

MMTR* 

29 

16,700 

59.6 

0.649 

13,600 

73.6 

2.33 

30 

19,200 

52.1 

0.651 

16,000 

62.6 

2.37 

31 

20,500 

48.7 

0.620 

17,200 

58.0 

2.32 

Configuration  A 
Configuration  B 
Configuration  C 


Notes  (1)  Maintenance  actions  per  million  operate  hours. 

(2)  Mean  time  between  maintenance  actions. 

(3)  Mean  manhours  to  repair 

(4)  Does  not  include  aircraft  peculiar  maintenance  tasks 


-if1,  iitf 


^ s-£ft-g-duled  Maintenance  - DFCS  batteries  will  require  inspection  and 
servicing  on  a 60-day  basis. 


?‘18’3  - Availability  is  a measure  of  the  degree  to  which  an  item  is 

in  the  operable  and  committable  state  at  the  start  of  the  mission,  when  the  mission 
is  called  for  at  an  unknown  (random)  point  in  time.  A comparison  of  the  DFCS  con- 
figurations indicating  the  relative  availability,  maintenance  manhours  per  operate 
hour,  and  time  to  repair  is  listed  in  Table  27. 


Table  27 

Flight  Line  Maintenance  Comparison  Summary 


Configuration 

| Mean  Corrective 
Down  Time  (MCDT) 
(Elapsed  Hours)(3) 

Mean  Maintenance 
Manhours  to  Repair 
(MMTR)(3> 

Maintenance  Manhours 
per  Operate  Hour 
(MMH/OH) 

Availability^) 

F-4  DFCS  'A' 
(3-3-3) (2) 

1.76 

2.20 

0.021 

0.98 

F-4  DFCS  'B' 
(4-3-4)<2) 

1.84 

2.23 

0.025 

0.97 

F-4  DFCS  C1 
(4-4-4)<2) 

1.76 

2.15 

0.027 

0.97 

No'es: 

(1)  Availability  = Mean  Time  Between  Maintenance  Actions  (MTBMA) 

MTBMA  + MCDT 

(2)  Excludes  Canard  Actuators,  Integrated  Torque  Boosters,  and  Displays 

(3)  Includes  Aircraft  Peculiar  Maintenance  Tasks 


2.18.4  CONCLUSIONS 

o Any  of  the  three  sound  candidate  configurations  are  expected  to  produce 

very  significant  reductions  in  maintenance  manhours  per  flight  hour  compared 
to  mechanical  control  systems, 

o Configuration  A (triplex)  would  require  less  maintenance  manhours  per  flight 
hour  than  either  of  the  other  configurations,  and 

o The  availability  of  all  three  configurations  is  approximately  97%. 
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2-19  EFFECTIVENESS  ANALYSTS 


2.19.1  INTRODUCTION  - Analyses  were  performed  to  ascertain  the  effectiveness  of  the 

Xl  CO"r01  la"S  f°r  C°"bat  se*“nts  defined  by  the  Mssion 

q H ‘ h%  Were  Performed  usiag  data  collected  from  an  all-digital 

lected  fromPH  the  course  of  the  DFCS  control  law  synthesis  and  dl^a  col- 

th  the  man-1^“ the- loop  simulations.  The  effectiveness  analyses  employed 

the  effectiveness  evaluation  criteria  discussed  in  Section  2.3.2.  P Y 


utiliLd^r~^GIaAL-. EFFEf  ^gN-ESS  ANALYSES  - All-digital  effectiveness  analyses  were 
utiiized  in  the  design  of  the  weapon  delivery  mode  control  laws.  The  all-digital 

sistSV:rSlineaaHySr  emPlTd  C!Tretical  Peking  models  from  Reference  S)  L- 
Hn  _ 8 , linearized  aircraft  and  control  system  dynamics,  tracking  geometry  rela- 

The  mT?  3 C°nStan^  ?ain  Pilot  model-  tracking  models  are  depicted  in  Figure  62 

e pilot  gains  used  in  the  simulations  were  the  gains  which  generated  the  best 

damping?S  WMCh  C°rreSP°nded  closely  to  the  gains  providing  the  best  system 


Air-to-Ground  Gunnery  Mode:  Kv  = 0,  r = -V 

Air-to-Ground  Bombing  Mode:  Kv  = 1,  r = — v 


Geometry  Dynamics 


Elevation 


Traverse 


Figure  62 

Theoretical  Tracking  Effectiveness  Models 


Representative  time  histories  of  the  normalized  tracking  error  responses 

ure^f  ^ all~digital  si^lation  tracking  models  are  illustrated  in  Fig- 
ure  63  for  air-to-ground  gunnery  with  the  roll  axis  stabilized  about  the  gun  line 
and  for  air-to-ground  bombing  with  the  roll  axis  stabilized  about  the  velocitv  ’ 


Reference:  25, 


Berger,  J.  B.,  et  al,  "Flight  Control  Requirements  for  Weapon 
Delivery,  Interim  Report  for  Period  June  1973  through  May  1974" 
Technical  Report  AFFDL-TR-74-119 , October  1974. 
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Table  28 

Capability  to  Null  Small  Tracking  Errors 


Air-to-Ground 
Bombing 
(Velocity  Vector 
Stabilized) 

Air-to-Ground 

Gunnery 

(Gun  Line  Stabilized) 

DLC  Superior  to 
Longitudinal  Stick 

Yes 

No 

Flat  Turn  Superior  to 
Lateral  Stick 

Yes 

Yes 

Lateral  Translation  Superior  to 
Lateral  Stick 

Yes 

No 
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2!19;3  MAN- IN-THE-LOOP  SIMULATION  EFFECTIVENESS  RESULTS  - Two  man-in- the- loop 
simulation  programs  were  conducted  in  which  customer  pilots  participated  and  effec- 
ataiQ7/6  accumulated.  The  Control  Law  Simulation  took  place  between 
30  September  1974  and  11  October  1974  on  the  SFCS  Flight  Simulator  with  five  pilots 
participating.  The  objectives  were  to  evaluate  and  refine  the  control  law  design 
based  on  effectiveness  and  handling  qualities  criteria,  with  conventional  cockpit 
displays.  The  primary  cockpit  controller  consisted  of  a base-pivot  SSC  mounted  at 
the  right  armrest  of  the  pilot’s  seat.  The  second  simulation,  the  Integrated 

19  7SrCl  Jr  MAr^TT?1^  Simulation’  t00k  Place  between  9 December  1974  and  17  January 
1975  on  the  MACS  III  air  combat  simulator  with  seven  pilots  participating.  The  objec- 
tives were  to  further  evaluate  and  refine  the  control  laws  and  advanced  cockpit  dis- 
plays, to  increase  weapon  delivery  effectiveness  and  reduce  pilot  workload  in  the 
performance  of  a complete  mission  scenario.  In  this  simulation  the  base-pivot  SSC 
was  replaced  with  a laboratory  model  palm-pivot  SSC. 

. , b°th  simulations,  the  weapon  delivery  mission  segments  were  flown  using 

the  DFCS  multimodes  and  the  DigiPACT  mode,  for  the  purpose  of  comparing  the  DFCS 
multimode  effectiveness  against  the  effectiveness  of  a general  purpose  fighter  con- 
trol law.  The  primary  data  reduction  method  was  statistical.  The  equations  which 
form  the  basis  for  this  data  reduction  are  presented  in  Table  29.  After  each  simu- 
lation  the  tracking  data  were  reduced  by  statistically  combining  tracking  results 
from  all  the  pilots  participating  in  that  simulation.  For  the  purposes  of  data 
reduction,  each  pilot  s results  were  weighted  equally,  and  no  attempt  was  made  to 
modify  the  results  based  on  experience  or  performance.  In  addition,  a figure  of 
merit  data  reduction  method  was  used  to  examine  the  results. 

Table  29 

Basic  Statistical  Analysis  Equations 


• Mean  (X(k)) 

1 k 

X<k)  = — I xn 

K n r.-  1 

• Variance  (E[X  — X]  2) 


EfX 


- o Ik 
X]  2 = 


9 1 k 

ir„5,x"-V  j 


>2  = 


1 


~ £ X‘-X‘(k) 

k n = 1 


(2  v 2/ 

n 


• Standard  Deviation  (E[X  - X] ) 

E[X  — XJ  =yf  Variance 

x is  the  variable 

n is  the  nth  sample 

k is  current  total  number  of  samples 

2:19:3-1  ^-°ntro1  Law  Simulation  Effectiveness  Results  - The  tracking  response  data 

sim  W T rePresentative  °f  the  data  collected  during  the  man-in-the-loop 

simulations.  Representative  statistical  effectiveness  data  from  the  Control  Law 
Simulation  are  presented  in  Figures  65  and  66.  Each  figure  shows  the  statistical 
mean  of  the  tracking  error  with  the  spread  of  the  data  represented  by  the  +1  stan- 

k”  6ither  Slde  °f  the  mean  Value'  For  comParison  purposes  the 
statistical  data  has  been  normalized  to  the  maximum  mean  +1  standard  deviation. 

nterpretation  of  these  data  can  be  based  on  the  standard  deviation  which  is  an 
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indication  of  the  variance  of  the  tracking  response  motion.  The  mean  error  may 
also  be  of  some  significance;  however,  experience  has  shown  that  pilots  often  track 
a target  point  offset  by  a bias  distance  proportional  to  the  range  to  the  actual 
target.  This  bias  will  cloud  any  conclusions  which  can  be  drawn  from  the  mean 
tracking  error. 
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Figure  64 

Man-in- Loop  Simulation 

Representative  Tracking  Response  Data 
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Figure  65 

Control  Law  Simulation 

Representative  Air-to-Air  Combat  Effectiveness  Data 
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Figure  66 

Control  Law  Simulation 

Representative  Air-to-Ground  Bombing  Effectiveness  Data 


Two  preliminary  air-to-air  combat  modes  investigated  during  the  Control  Law 
Simulation  were  the  ACM  and  the  AACM.  The  air-to-air  tracking  results  presented  in 
Figure  65  show  that  the  ACM  was  superior  to  the  AACM,  and  the  AACM  was  therefore 
dropped  from  further  evaluation.  Both  the  Normal  Mode  and  DigiPACT  Mode  were  in- 
cluded in  these  data  to  form  a baseline  for  data  comparisons.  The  air-to-air  track- 
ing data  shown  were  taken  during  an  eight  second  period  of  a tracking  maneuver  in 
which  the  target  maintained  a 3g  turn.  The  superiority  of  the  ACM  in  the  tracking 
role  resulted  from  providing  improved  pitch  control  at  high  angles-of-attack  and 
improved  roll  characteristics. 

Figure  66  presents  representative  bombing  effectiveness  data  results  for  the 
Normal,  DigiPACT  and  Air-to-Ground  Bombing  Modes.  The  lateral  tracking  error  was 
analyzed  for  10  seconds  prior  to  bomb  release  and  at  the  bomb  release  point,  while 
the  other  errors  were  analyzed  at  the  bomb  release  point  only.  The  data  shows  the 
Air-to-Ground  Bombing  Mode  superior  to  the  other  modes  in  tracking  to  the  target 
and  capturing  the  desired  release  point  conditions.  Bombing  effectiveness  results 
show  that  most  of  the  improvement  with  the  Bombing  Mode  was  in  the  lateral  axis 
where  the  elimination  of  the  pendulum  effect  and  the  ability  to  roll  around  a 
stabilized  velocity  vector  produced  superior  lateral  tracking.  The  flat  turning 
capability  was  useful  in  eliminating  small  tracking  errors.  Lateral  translation  was 
used  to  advantage  to  offset  crosswinds  on  the  bomb  runs.  No  Air-to-Ground  Gunnery 
Mode  effectiveness  data  are  presented  for  the  Control  Law  Simulation  because  an 
error,  which  influenced  the  effectiveness  data  results,  was  discovered  in  the  simu- 
lation of  the  Air-to-Ground  Gunnery  Mode  subsequent  to  the  end  of  the  simulation. 
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Pilot  comments  concerning  the  Control  Law  Simulation  indicated  that  the  mount 
and  armrest  adjustability  of  the  base-pivot  SSC  was  inadequate.  As  a result,  in  the 
interim  period  between  the  Control  Law  Simulation  and  the  Integrated  Control  Law  and 
Display  Simulation,  MCAIR  pilots  evaluated  the  base-pivot  SSC  with  improved  adjust- 
ment capability  against  a laboratory  model  palm-pivot  SSC.  MCAIR  pilots  found  that 
they  preferred  the  laboratory  model  palm-pivot  SSC.  Therefore,  this  SSC  was  used  in 
the  Integrated  Control  Law  and  Display  Simulation  with  the  forces  adjusted  to  MCAIR 
pilots'  preferences. 


2.19.3.2  Integrated  Control  Law  and  Display  Simulation  Effectiveness  Results  - Air- 
to-air  tracking  was  performed  in  the  Integrated  Control  Law  and  Display  Simulation 
with  a fixed  reticle  display  alone  and  with  a fixed  reticle  display  and  additional 
pertinent  information  on  the  HUD.  Air-to-ground  segments  were  flown  with  these  two 
types  of  fixed  reticle  displays  and  also  with  a computed  or  dynamic  reticle  display. 
No  significant  difference  was  noted  in  the  relative  tracking  results  as  a function 
of  the  display  used.  Therefore,  tracking  data  for  the  Integrated  Control  Law  and 
Display  Simulation  can  be  represented  by  the  fixed  reticle  display  results  alone. 

Representative  statistical  results  for  the  fixed  reticle  display  are  shown  in 
Figures  67  and  68.  The  limited  time  available  for  the  Integrated  Control  Law  and 
Display  Simulation  permitted  comparison  of  the  weapon  delivery  modes  to  the  DigiPACT 
Mode  only.  The  data  presented  in  Figure  67  for  the  air-to-air  combat  segment  show 
the  ACM  to  be  superior  compared  to  the  DigiPACT  Mode.  Results  of  the  air-to-ground 
guns  segment  showed  the  Air-to-Ground  Gunnery  Mode  superior  to  the  DigiPACT  Mode  in 
tracking  effectiveness.  Features  which  contributed  to  the  superiority  of  the 
Air-to-Ground  Gunnery  Mode  included  flat  turn  capability,  roll  about  the  gun  line 
axis,  and  pitch  rate  control  for  small  pitch  inputs.  Bombing  results  are  not 
included  in  these  data  as  the  results  were  not  found  to  be  significantly  different 
from  the  Control  Law  Simulation. 


Normalized 
Tracking  Error 
Mean  ± 1 
Std  Deviation 


DigiPACT  DigiPACT  DigiPACT  Mode 


Lateral 

Error 


Vertical 

Error 


Radial 

Error 


Figure  67 

Integrated  Control  Law  and  Display  Simulation 
Representative  Air-to-Air  Combat  Effectiveness  Data 
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Figure  68 

Integrated  Control  Law  and  Display  Simulation 
Representative  Air-to-Ground  Gunnery  Effectiveness  Data 


Several  additional  types  of  data  reduction  were  employed  to  obtain  some  addi- 
tional information  on  the  data  trends  of  the  Integrated  Control  Law  and  Display 
Simulation.  The  results  of  a Figure  of  Merit  method  are  shown  in  Figure  69  for  the 
air-to-air  combat  segment.  Superiority  of  the  ACM  is  apparent  from  these  data  which 
quantify  the  visual  observations  made  by  pilots  and  simulation  observers. 


Tracking  Figure  of  Merit 
( FOM ) Results 


Figure  69 

Integrated  Control  Law  and  Display  Simulation 
Representative  Air-to-Air  Combat  Effectiveness  Data 
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The  data  presented  in  Figure  70  is  a comparison  of  effectiveness  data  from  the 
Integrated  Control  Law  and  Display  Simulation  between  pilots  who  had  not  previously 
participated  in  the  simulated  weapon  delivery  and  pilot  who  had  previously  partici- 
pated in  the  Control  Law  Simulation.  Tracking  results  for  the  air-to-air  combat 
segment  show  that  the  pilots  with  the  previous  experience  achieved  approximately 
equal  performance  with  the  ACM  and  DigiPACT  Modes  while  the  other  pilots  achieved 
better  performance  with  the  ACM.  This  comparison  indicates  that  with  sufficient 
experience,  a pilot  who  is  well  rehearsed  in  a particular  air-to-air  tracking  pro- 
file can  learn  to  perform  well  on  the  simulator  with  either  the  ACM  or  DigiPACT 
Mode.  On  the  other  hand,  a pilot  without  the  previous  experience  or  one  who  is 
performing  a more  realistically  unfamiliar  profile  can  achieve  better  results  with 
the  ACM  than  with  the  DigiPACT  Mode.  Additional  supporting  evidence  of  this  result 
is  apparent  in  the  air  combat  effectiveness  comparison  in  Figure  71  where  overall 
tracking  effectiveness  with  all  four  control  modes  was  improved  and  the  relative 
differences  among  modes  were  reduced  for  the  second  data  taking  session  (Friday)  as 
compared  to  the  initial  data  taking  session  (Tuesday)  of  the  Control  Law  Simulation. 
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Figure  70 

Integrated  Control  Law  and  Display  Simulation 
Comparison  of  Air-to-Air  Combat  Effectiveness  Data 

On  the  final  day  of  the  Integrated  Control  Law  and  Display  Simulation,  three  of 
the  customer  pilots  evaluated  the  base-pivot  SSC,  with  improved  adjustability,  by 
performing  air-to-air  tracking.  Statistical  tracking  data  were  not  recorded  for 
these  evaluations,  but  the  tracking  was  visually  observed  to  be  significantly  im- 
proved with  the  base-pivot  SSC,  and  the  pilots  stated  their  preference  for  the  base- 
pivot  SSC  in  the  final  debriefing  session. 


Further  work  on  the  SSC  is  required  to  determine  the  most  desirable  stick 
characteristics . 


Normalized 
Tracking  Error 
Mean  ±1 
Std  Deviation 


Second  Attempt 


Norm  AACM  Norm  AACM  Norm  AACM 
DigiPACT  ACM  DigiPACT  ACM  DigiPACT  ACM 


Lateral  Error 


T 

Vertical  Error 


Radial  Error 


Figure  71 

Control  Law  Simulation 

Comparison  of  Air-to-Air  Combat  Effectiveness  Data 


2.19  4 CONCLUSION  - Increased  tracking  effectiveness  using  the  multimodes  was 

t-l^-  i*  a*  St  °th  the  DFCS  man-in-the-loop  simulations.  The  trend  of  the  sta- 
tistxca1  data  shows  that  the  multimode  control  laws  produce  better  tracking  results 

Oh  i8aru  °f,merit  data  analyses  produced  essentially  the  same  results  as  visually* 

fivTlh^  „ MP  J0t^  indl<:at1^  multimode  control  laws w“e  m^e  effej- 

tive.  The  combined  effects  of  pilot  experience  with  the  ACM  and  the  DigiPACT  Mode 
and  experience  in  tracking  a target  aircraft  performing  duplicate  evasive  maneuver; 

laws  0 t”h  \h”  TV  < the  Pll°tS  c°"'’ensate  £or  differences  in  the  control 
„0n  5,'e  «ther  hand,  with  less  previous  experience,  and  confronted  with  more 
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2.20  WORKLOAD  ANALYSIS 


2.20.1  INTRODUCTION  - An  analysis  has  been  performed  in  which  pilot  workload  was 
estimated  and  measured  in  both  static  and  dynamic  (man-in-the-loop)  simulations. 
The  purpose  of  the  analysis  was  to  show  the  effect  of  the  DFCS  configuration  on 
pilot  workload  throughout  all  phases  of  the  aircraft  mission.  It  is  intended  that 
the  workload  values  be  used  as  comparisons  of  pilot  workload  rather  than  absolute 
values,  e.g. , comparisons  of  pilot  workload  differences  between  mission  segments 
or  comparisons  of  different  crew  station  configurations.  The  analytical  methods 
used  and  results  obtained  are  presented  in  the  following  paragraphs. 


2.20.2  ANALYTICAL  METHODS  - The  workload  analysis  utilized  inputs  from  a variety 
of  DFCS  analyses  and  simulations.  These  included: 


o Mission  Scenario  Analysis  (see  Section  2.2), 
o Static  Design  Aid  Evaluation  (see  Section  3.2), 
o Control  Law  Development  (see  Section  2.4), 

o Dynamic  (man-in-the-loop)  Simualtions  (see  Section  3.3),  and 
o Workload  Evaluation  Criteria  (see  Section  2.3). 


Figure  72  shows  these  areas  and  their  inputs  to  the  workload  analysis 
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Figure  72 

Pilot  Workload  Analysis 


use  of  the  MCAIR  Pilot  Simulation  Model, 


Calculation  of  pilot  workload  made 
References  (26)  and  (27). 

simulati^V^and0  RESULf  ” Woi*load  data  were  analyzed  for  both  static  and  dynamic 
simulations  and  comparisons  made  as  illustrated  in  Figure  73.  Direct  comparison 

between  the  dynamic  DECS  evaluation  and  dynamic  advanced  fighter  were  not  pf  Xe 
d.ie  to  a lack  of  dynamic  workload  data  for  the  advanced  fighter  Possible 


Static  Workload  Comparison 


Figure  73 

Pilot  Workload  Data  Comparisons 


Sectffff  ®imula^ion’  consisting  of  a design  aid  evaluation,  is  described  in 
f , * * ata  gathered  from  this  evaluation  were  used  for  workload  calculation' 

or  both  the  DFCS  and  Advanced  Fighter  configurations.  Comparison  was  then  made 
between  the  results  of  these  two  static  simulations. 


calculating  of  thi^;  ? f ^n-in-the-loop  data  which  was  used  for  workload 
to fid  what if  configuration.  These  workload  calculations  were  used  first 

hinh  cnrrf  r-  ^correlation  existed  with  the  static  DFCS  workload  data.  A 
fons  staff °Vh  validity  between  the  two  methods  of  workload  calcula- 

and  the  sf tf  Lva^ff ghff ariS°nS  ^ ^ “de  betWee"  the  d^amic 
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27.  Asiala,  C.F. , "Role  of  Digital  Computer  Models  in  Training 

Device  Design  Performance  Measures,"  NAVTRADEVCENIH-206 
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2.20.3.1  Static  Workload  Comparisons  - Seven  of  the  14  mission  segments  described 
ir  Section  2.2  were  simulated  to  determine  pilot  workload.  These  seven  were: 

o Takeoff  and  climb, 

o Cruise, 

o Air-to-ground  attactc  - Bomb, 
o Air-to-air  combat  - MRM, 
o Air-to-air  combat  - SRM, 
o Air-to-air  combat  - Gun,  and 
o Approach  and  landing. 

Each  of  these  segments  was  simulated  for  both  the  DFCS  and  the  Advanced  Fighter 
configuration.  These  simulations  were  performed  using  the  idealized  mission  segment 
task  analysis  (Section  2.2).  Table  30  shows  the  workload  values  for  the  DFCS  and 
Advanced  Fighter  configurations  for  the  seven  simulated  mission  segments.  Values 
are  expressed  as  a percentage  of  the  time  required  to  perform  the  mission  segment 
tasks  to  the  time  available  for  those  tasks.  The  total  workload  has  been  divided 
between  the  four  major  workload  components.  The  average  figure  shown  is  the 
average  of  the  four  workload  components. 


Table  30 

Static  Workload  Comparisons 
DFCS  vs  Advanced  Fighter 


Mission 

Segment 


Aircraft 


Taakned  ” Cruise  Air  to  Ground  | 

Climb  Attack  <Bomb)[  MRM 
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Air-to-Air 

SRM 


OFCS  DFCS 


The  bottom  line  of  Table  30  shows  the  percentage  by  which  the  average  Advanced 
Fighter  workload  was  reduced  by  the  DFCS  configuration.  It  is  calculated  as: 

Advanced  Fighter  average  workload  - DFCS  average  workload 


Advanced  Fighter  average  workload 
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a reduced  workload.  Thengreaterreduc-ioLSwrrlafed^t?e  DFCS  conf i8uration  showed 
segments,  namely  takeoff  and  climb  cruise  a 6 f°Und  ^ the  non-combat  mission 
in  these  segments  was  a result  ^ redUCti°n 

o Introduction  of  a flight  management  system, 

flight 'management  "computer  wftte^iE”8  ^ COinmUnication  betwa«n  the 

Jion°dUCti°n  °f  3dvanced  disPlays  which  centralized  primary  flight  informa- 

0 Use  of  a slde  stick  controller,  and 

Hold^Ut^a?  «<i  Altitude 

pilot  t as kTogi '"network  and  Dynamic  Workload  Values  - The 

to  conform  to  the  actual  mission  segment  events  ! dynam1c  simulation  data  and 
grated  Control  Law  and  Display  Simulation  J*  tbe^  were  flown  in  the  Inte- 
tion  was  flown  in  this  simulation.  ection  3.3).  Only  the  DFCS  configura- 

segmenTts1:s3u1s:^  £ p^S^S^“-Ult>  «"  ^ — -en  mission 
configuration  static  workload  simulation  ’ This  hWlth  ValU6S  fr°m  the  DFCS 

the  average  workload  results  for  dynamic’and  J table.sh°Ws.8ood  agreement  between 
seven  segments  examined.  Y ° and  Static  simulations  for  each  of  the 

Table  31 

DFCS  Static  and  Dynamic  Workload  Comparison 
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Correlation  coefficients  (r  = Pearson  product-moment)  were  calculated  from  the 
data  presented  in  Table  31  for  each  of  the  sensory  modes  and  their  average  across  the 
seven  mission  segments.  The  results  were: 


o visual 
o right  hand 
o left  hand 

o information  processing 
o average  workload 


r = 0.902 
r = 0.986 
r = 0.987 
r = 0.989 
r = 0.995 


Since  the  range  of  the  correlation  coefficient  is  from  -1.0  to  -rl.0,  the  results 
shown  above  indicate  a high  positive  correlation  in  each  area.  This  shows  that  the 
static  workload  results  were,  in  fact,  a good  predictor  of  what  would  be  found  when 
actual  man-in-the-loop  simulation  data  was  used  in  the  generation  of  workload  results. 

The  high  positive  correlations  provided  validation  of  the  static  workload 
results  as  good  predictors  of  dynamic  workload  and  permitted  the  comparison  between 
the  dynamic  DFCS  and  static  Advanced  Fighter  workload  results  presented  in  the  next 
section. 

2.20.3.3  Dynamic  Workload  Comparison  - Comparison  of  average  workload  data  for  the 
dynamic  DFCS  and  the  static  Advanced  Fighter  are  shown  in  Figure  74.  A reduction  in 
workload  is  shown  for  the  DFCS  in  each  of  the  seven  mission  segments.  Greatest 
workload  savings  are  found  in  the  takeoff  and  climb,  cruise,  and  approach  and  land- 
ing segments. 


Total  Workload  for  Mission  Segments  (Average  of  6 Pilots) 


Workload 


2.20.4  CONCLUSIONS  - The  following  conclusions  have  been  drawn  from  the  preceding 
comparisons  of  pilot  workload  for  the  DFCS  equipped  aircraft  to  that  for  the 
advanced  fighter. 

o The  DFCS  configuration  showed  a reduced  workload  in  each  of  the  seven  seg- 
ments simulated. 

o Reduced  pilot  workload  resulted  primarily  from  the  introduction  of  a flight 
management  system  by  establishing: 

o Simple,  effective  means  of  communication  between  the  flight  management 
computer  and  the  pilot, 

o Eliminating  routine  tasks  traditionally  performed  by  pilots, 

o Restructuring  the  information  available  for  the  decision  process, 

o Automation  of  the  flight  activities  through  pilot- relief  modes,  and 

o Integration  of  flight  control  modes  with  relevant  display  formats. 

o Steps  were  taken  toward  making  the  pilot  a mission-oriented  manager  rather 
than  a subsystem  operator. 
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2.21  SURVIVABILITY  ANALYSIS 


A survivability  analysis  was  conducted  for  each  of  the  three  sound  candidate 
configurations  considered  during  the  study.  The  analysis  employed  survivability 
logic  diagrams  (SLD)  and  the  computer  program  developed  in  the  Survivability 
Assessment  Guidelines  for  Flight  Control  Systems  (SAG-FCS)  study  for  AFFDL,  Refer- 
ence (28).  The  threats  and  flight  profiles  used  to  determine  projectile  hit  densi- 
ties and  striking  velocities  were  the  same  as  those  used  in  the  SFCS  survivability 
analysis.  Reference  (29).  The  SLDs  replace  the  killing  combination  charts  (dot 
charts)  used  in  the  Reference  (29)  survivability  analysis,  and  define  combinations 
of  critical  components  which  must  survive  for  the  aircraft  to  survive.  A flight 
control  system  loss  comparison  among  the  F-4E,  SFCS  and  DFCS  configurations  is  pre- 
sented in  Figure  75.  These  data  are  presented  for  15  degree  dive  angle  attacks 
against  a 23mm  defense  with  a "3  scaled"  density  as  defined  in  Reference  (29). 


Percent  of  Total  Losses  Attributable  to  the  Flight  Control  System 


Figure  75 

Flight  Control  System  Loss  Comparison 
23  mm  Defense  15°  Dive 


Conclusion 

The  survivability  analysis  showed  no  significant  survivability  differences  among 
the  three  sound  candidate  configurations. 


References:  28. 

I 

29. 


AFFDL-TR-74- 39  Vol  I,  "Survivability  Assessment  Guidelines  for 
Flight  Control  Systems",  June  1974. 

AFFDL-TR-73-105  Supplement  1,  "Survivable  Flight  Control  System 
Final  Report,  Supplement  for  Survivability  Analysis",  December 
1973  (Confidential). 
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2.2?  COST-OF-OWNERSHIP  ANALYSIS 


The  three  sound  candidate  DFCS  configurations,  excluding  the  displays  and 
controllers,  were  analyzed  for  total  cost-of-ownership . The  DFCS  was  assumed  to  be 
a subsystem  of  the  aircraft  in  a TAG  fighter  squadron.  The  squadron  was  assumed  to 
consist  of  24  aircraft  which  flew  45  hours  per  month  for  10  years,  with  50%  over- 
seas and  50%  Continental  U.S.  Mean  time  between  unscheduled  maintenance  action  and 
maintenance  manhours  per  operating  hour  were  estimated  for  each  configuration. 
Operations  and  Maintenance  (O&M)  costs  were  estimated  for  a squadron  for  10  years. 
Optimum  Repair  Level  Analysis  (ORLA)  equations  for  the  major  cost  gererating  cate- 
gories were  modified  to  express  these  costs  as  functions  of  maintenance  manhours 
per  operating  hour,  ratio  of  operating  hours  to  flight  hours,  unit  cost  per  configu- 
ration, mean  time  between  unscheduled  maintenance  actions  off  aircraft  and 
configuration  weight.  Acquisition  costs  were  calculated  from  standard  cost  esti- 
mating relationships  that  have  been  developed  for  costing  subsystems  of  advanced 
design  aircraft;  these  include  RDT&E  and  investment.  Investment  cost  calculations 
were  based  on  an  assumed  buy  of  720  aircraft  sets. 

Table  32  shows  the  relative  cost  of  Configurations  B and^C  normalized  to  Con- 
figuration  A.  Also  shown  in  Table  32  are  the  relative  Requisition  and  relative  ten 
year  operations  and  maintenance  costs  for  each  conf igtiration  normalized  to  Configu- 
ration A. 
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Table  32 

Relative  Cost-of-Ownership  Acquisition  and  Ten  Year  O&M  Cost 


Configuration 

Relative 

Acquisition 

Cost 

Relative 
Ten  Year 
O&M  Cost 

Relative 
Cost  of 
Ownership 

A 

0.37 

0.63 

1.00 

B 

0.45 

0.90 

1.35 

C 

0.44 

0.98 

1.42 

CONCLUSION 

The  conclusion  of  the  cost-of-ownership  analysis  is  that  Configuration  A has 
the  least  total  cost. 
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3 . 0 DESIGN  AID  AND  SIMULATIONS 

3.1  GENERAL 

This  section  describes  the  cockpit  mockup , design  aid  and  man-in-Ioop  simula- 
tion efforts  performed  during  the  DFCS  definition  study.  Iterative  evaluations 
using  these  laboratory  tools  helped  to  define  an  acceptable  cockpit  arrangement, 
light  control  laws,  and  compatible  displays  and  controllers,  and  to  determine  their 
effects  on  pilot  workload  and  mission  effectiveness.  Twelve  customer  pilots.  Table 
33,  participated  in  design  aid  and  simulation  evaluations  conducted  during  the  time 
period  June  1974  through  January  1975,  Figure  76. 
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Table  33 
Evaluation  Pilots 


Name  and  Activity 

No.  Fighter 
Typ"  A/C 
Flown 

Total 
No.  Fit 
Hours 

Combat  Experience 

Special 

Experience 

Simulation  Participation 

Design 

Aid 

Control 

Law 

Integrated 
CL  61  Displ 

Larry  A.  Walker 
Capt.  USMC 
NATO  Pax  River 

6 

1983 

150  A/G  Missions 

HUD 

Side  Stick 

J 

J 

J 

Sam  Herron 
AFFDL,  W/P  AFB 

3 

4850 

100  Recon  Missions 

J 

- 

J 

Doyle  Borchers 
LCDR  USN 
VF-124,  Miramar  NAS 

6 

1680 

130  Strike  Missions  over  N.  Vietnam 

HUD 
Over  300 
Carrier  Landings 

J 

- 

J 

V.L.  Strock 
Capt.  USAF 
1 FC.  Randolph  AFB 

2 

1800 

Vietnam  Tour 

J 

- 

- 

R.K.  Johnson 
Major  USMC 
NATC  Pax  River 

12 

4600 

100  Cap  & ECM  Escort  Missions 
225  Night  All  Weather  Attack  Missions 

HUD 

700  Carrier 
Landings 

J 

- 

- 

Richard  M.  Cooper 
Major  USAF 
TPS  Edwards  AFB 

3 

3200 

550  Missions  (260  Over  N.  Vietnam) 
1200  Combat  Hours 

Side  Stick  Cont 
in  F-104 

J 

- 

- 

John  Hoffman 
Major  USAF 
6512  Test  Sq.. 
Edwards  AFB 

5 

2723 

388  Hours  (F-105  A/G  Missions) 

HUD 

- 

J 

J 

Duane  Zeig 

Major  USAF 

4950  Test  Wg.  W/P  AFB 

4 

2300 

100  A/G  Missions  in  F-105 

- 

J 

John  B.  McDonald 
Major  USAF 
FTC  Edwards  AFB 

6 

3974 

Vietnam  Tour  in  F-4 

Sidr  Stick  Cont 
in  F-104 

- 

J 

Barry  Gastrock 
LCDR  USN 
NATC  Pax  River 

9 

2365 

135  A/G  Missions 

80  - Photo  Recon  Missions 

HUD 

- 

y 

J 

Richard  E.  Lawyer 
Lt.  Col.  USAF 
Ftr  Ops  Kirtland  AFB 

11 

5200 

Vietnam  Tour 

Side  $tick  Cont 
in  F-101  & F-104 

- 

- 

J 

Robert  Ettinger 
Major  USAF 
FTP  Operations, 
Edwards  AFB 

7 

3242 

Vietnam  Tour  in  F-4 

Side  Stick  Cont  in 
NF-106,  F-104,  F4 
(SFCS  & PACT), 
NT-33  81  YF  16 

- 

- 

J 
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Figure  76 

Timing  of  Design  Aid  end  Simulations 

This  section  discusses  design  aid  and  simulation  activities  under  the  following 
subsections : 

o Cockpit  Design  Aid  and  Mockup 

o Design  Aid 
o Static  Mockup 
o Configuration  Evaluation 

o Simulations 
o Control  Law 
o Dynamic  Displays 

o Integrated  Control  Law  and  Display 
3.2  COCKPIT  DESIGN  AID  AND  MOCKUP 

A design  aid  was  developed  which  was  representative  of  the  Digital  FCS  displays 
and  controllers  arrangement  as  it  evolved.  An  existing  mockup,  which  was  represen- 
tative of  a single  place  advanced  tactical  fighter,  was  utilized.  Both  the  design 
aid  and  the  mockup  were  used  for  Digital  FCS  display  and  controller  evaluations  by 
pilots  and  engineering  psychologists  and  physiologists. 

3.2.1  DESIGN  AID  - A full-scale  design  aid  was  built  to  F-4  front  cockpit  dimen-^ 
sions.  Installed  in  the  design  aid  was  a standard  F-4  ejection  seat,  and  the  DFCS 
displays  and  controllers  arrangements  developed  during  the  analyses.  The  design  aid 
was  constructed  from  foam  core  and  wood  to  permit  rapid  reconfiguration  as  the  design 
progressed.  The  displays,  instruments,  and  switches  were,  in  general,  represented  by 
drawings,  photographs,  and  mockups.  An  SSC  and  a throttle  assembly  were  mounted  on 
the  seat.  Figure  77  presents  the  design  aid  which  evolved  through  successive  itera- 
tions during  the  static  evaluation. 

Subsequently,  the  design  aid  was  modified  to  accept  the  actual  DFCS  displays, 
controllers,  and  other  hardware  and  used  during  the  Integrated  Control  Law  and 
Display  Simulation. 
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3.2.2  STATIC  MOCKUP  - An  existing  full  scale  static  mockup  which  was  representative 
of  a single  place  advanced  tactical  fighter  was  used  to  establish  baseline  data  for 
the  pilot  workload  analysis.  Figure  78  provides  a view  of  the  advanced  fighter 
static  mockup. 


Figure  77 
DFCS  Design  Aid 


Figure  78 
Static  Mockup 

Advanced  Fighter 


3" 2* 3 CONFIGURATION  EVALUATION  - Six  experienced  fighter  pilots,  two  each  from  the 
Air  Force,  Navy,  and  Marine  Corps,  participated  in  the  configuration  evaluations. 
Evaluations  were  performed  using  the  static  mockup  and  the  DFCS  design  aid  to  verify 
the  acceptability  of  the  cockpit  geometry;  and  to  determine  the  ease  and  speed  of  the 
pilot  s movements  in  performance  of  operational  tasks.  The  mission  scenario  was 
exercised  and  qualitative  assessments  were  made  to  determine  whether  each  task  could 
be  performed.  The  time  required  to  perform  selected  tasks  was  recorded  for  use  in 
the  pilot  workload  analysis  discussed  in  Section  2.20.  The  evaluation  was  conducted 
by  using  the  following  techniques: 

o Pilot  briefing, 

o Pilot  background  questionnaire, 

o Pilot  anthiopometry , 

o Task  performance, 

o Mission  scenario  analysis, 

o Questionnaire,  and 

r Pilot  critique  and  debriefing. 

A brief  description  of  each  of  the  above  techniques  is  provided  in  the  following 
paragraphs. 

3*2»3.i  Pilot  Briefing  - During  this  briefing,  the  pilots  were  familiarized  with 
the  general  objectives  of  the  evaluation  and  the  evaluation  plan.  An  overview  of 
the  program,  aircraft  operational  features  and  crew  station  design  were  presented. 

3. 2. 3. 2 Pilot  Background  Questionnaire  - This  questionnaire  was  a written  list  of 
short-answer  questions  formulated  to  ascertain  pilot  experience  in  a variety  of 
areas.  These  areas  included: 

o Type  of  aircraft  flown, 
o Aircraft  currency, 
o Aircraft  experience  (log  hours), 
o Air  combat  experience,  and 
o Air-to-ground  weapons  delivery  experience. 

The  answers  to  these  questions  showed  the  high  quality  and  diversification  of  pilot 
experience  applied  to  this  evaluation. 

3. 2. 3. 3 Anthropometric  Measurements  - Anthropometric  measurements  were  taken  for 
each  pilot.  The  measurements  were  made  to  determine  the  relative  pilot  size  for 
such  dimensions  as  sitting  eye  height  and  reach  distance.  Each  pilot’s  capability 
to  reach  and  operate  controllers  and  instruments  was  then  evaluated. 

Measurements  using  anthropometric  measurement  instruments  were  made  on  each 
pilot  wearing  his  flight  suit.  In  all  cases,  the  pilot  either  stood  or  sat  in  an 
erect  manner.  In  general,  the  six  pilots  were  in  the  50th  - 99th  percentile  range 
which  provided  adequate  evaluation  by  large  pilots. 
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Measurements  were  also  taken  on  four  additional  pilots  during  the  Control  Law 
Simulation.  The  measurements  of  two  of  these  pilots  are  representative  of  the  lower 
percentiles,  5th  - 50th,  and  provided  adequate  evaluation  by  small  pilots. 

3. 2. 3. 4 Task  Performance  - Pilot  performance  of  flight  tasks  were  measured  and 
recorded.  The  pilot  was  seated  in  the  Digital  FCS  design  aid,  wearing  standard 
flight  equipment.  He  was  instructed  to  perform  a specific  task  as  quickly  as  pos- 
sible. Each  task  started  from  a neutral  position  with  the  left  hand  on  the 
throttles  and  the  right  hand  on  the  flight  controller.  The  elapsed  time  beginning 
from  and  returning  to  the  neutral  position  was  measured  with  a stop  watch.  Tasks 
required  to  perform  the  same  functions  were  timed  in  the  advanced  fighter  mockup. 
Task  times  from  both  arrangements  were  used  in  the  static  and  dynamic  workload 
analysis . 


3.2. 3.5  Mission  Scenario  Analysis  - Task  evaluation  based  upon  the  mission  scenario 
segments  was  performed  in  both  the  Digital  FCS  design  aid  and  the  advanced  fighter 
mockup.  Comments  on  tasks  performed  by  pilots  were  recorded.  These  data  included 
pilot  opinions  as  to  the  appropriateness  of  the  mission  scenario  task  identification. 
The  purpose  of  this  activity  was  to  allow  the  pilot  to  "fly"  the  aircraft  through  a 
complete  mission  in  order  to  determine  if  the  controllers  and  displays  in  the  crew 
station  were  adequate  to  accomplish  the  tasks  required  of  the  pilot.  The  mission 
scenario  included  all  fourteen  mission  segments  described  in  Section  2.  The  pilot 
was  "talked  through"  each  of  these  segments.  He  operated  the  controls  as  required 
and  reach  capability  in  the  crew  station  was  noted. 

The  six  pilots  found  the  mission  scenario  and  tasks  to  be  realistic.  All  gave 
tentative  approval  of  the  DFCS  crew  station  design  and  concepts  for  such  a mission. 
This  approval  was  dependent  upon  simulated  and  actual  flight  testing.  No  major 
reach  problems  were  observed  with  any  pilot. 

Questionnaires  - Pilots  were  given  questionnaires  comparing  different  concepts 
within  and  between  the  two  crew  stations.  Table  34  lists  the  questions  and  the 
pilot  selections,  which  compared  the  DFCS  crew  station  with  tne  advanced  fighter. 

The  number  of  pilots  selecting  a specific  concept  is  noted  adjacent  to  the  concept. 
The  total  of  pilot  selections  for  each  arrangement  is  noted  at  the  end  of  the  list 
and  demonstrates  a strong  preference  for  the  DFCS  arrangement. 

3.2. 3. 7 Pilot  Critique  and  Debriefing  - In  the  pilot  critique  each  pilot  was  asked 
to  candidly  critique  the  Digital  FCS  design  aid.  The  pilot  sat  in  the  design  aid 
and  was  encouraged  to  give  his  opinions  and  ideas  on  the  cockpit  layout  and  the 
controller  and  design  concept.  He  was  also  asked  to  respond  to  a number  of  pre- 
pared questions  covering  the  relevant  areas  of  the  cockpit  arrangement. 

A debriefing  was  conducted  at  the  end  of  each  evaluation  in  which  all  pilots 
were  interviewed  together.  This  debriefing  was  an  open  exchange  of  ideas  and  com- 
ments related  to  the  design  aid  arrangements  and  the  evaluation  procedure. 

3. 2. 3.8  Conclusion  - The  configuration  evaluation  was  conducted  using  the  Digital 
FCS  design  aid  and  the  advanced  fighter  mockup.  Six  pilots  from  the  Air  Force, 

Navy,  and  Marine  Corps  participated  in  three  separate  displays  and  controllers 
evaluations.  Data  collected  from  pilot  background  questionnaires,  anthropometric 
measurements,  paired  comparison  questionnaires,  and  pilot  critiques  and  debriefings 
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Table  34 

Pilot  Opinions  of  DFCS  vs  Advanced  Fighter 


1.  Communication  Control 
Location 

2.  Communication  Control  Type 

3.  Radar  Control  Panel 
Location 

4.  Throttle  Location 

5.  Throttle  Throw 

6.  Select  Jettison  Control 
Locetion 

7.  HUD  Control  Panel 
Location 

8.  Redar  Display 

9.  Threat  Information  Display 

10.  Standby  Instrument  Location 

1 1 . Fuel  Quantity  Gauge  Location 

12.  Navigation  Control  Panel 

13.  Navigation  Control  Penel 
Location 

14.  Navigation  Display  (Horizontal 
SituationIType 

15.  Flight  Controller  Location 


Totals 


DFCS 

A 

Main  Panel 
Top  Center 

4 

Keyboard 

5 

Right  Console  - 
FwiT 

3 

Seat  Armrest 

5 

Short  (6  in.) 
Throw 

6 

Center  Lower 
Main  Penel 

3 

Left  Console 

1 

Time  - Shered 

6 

Time  - Shared 

5 

Right  Mein 
Panel 

0 

Right  Console  - 
Fwd 

3 

Integrated 

4 

Left  Console  - 
Fwd 

3 

Time  - Shared 

4 

Side  Arm 

4 

56 

/^\  Advanced  Fighter  A 


Left  Console 

Thumbwheel 
Left  Console 

Left  Console 


Left  Main 
Panel 

Top  Center 
Main  Panel 

Dedicated 

Dedicated 

Lower  Center 
Mein  Panel 

Right  Main 
Panel 

Dedicated 


/l\  Number  of  pilots  who  preferred  this  concept 


Were  used  to  verify  the  acceptability  of  the  cockpit  arrangement  and  to  make  changes 
where  indicated.  Task  performance  data  was  taken  and  used  in  the  workload  analysis. 

No  major  reach  problems  were  observed  and  each  pilot  generally  approved  of  the 
DFCS  crew  station  design  and  concepts. 

3.3  SIMULATIONS 

Three  man-in- the-loop  simulations  were  performed  to  evaluate,  refine,  and 
verify  the  control  laws,  displays  and  controllers  discussed  in  Section  2.  The  three 
simulations  were  the: 

o Control  Law  Simulation, 

o Dynamic  Display  Simulation,  and 

o Integrated  Control  Law  and  Display  Simulation. 


i 


These  iterative 
combination  of 
tion. 


‘““tured  80  38  to  converge  on  the  most  effective 
1 laws,  displays  and  controllers  for  the  DFCS  ADP  defini- 


te objectives  of  these  simulations  were  to  determine: 
o The  soundness  of  the  basic  DFCS  concept, 

° oT£^rSe«!  :ires  ln  flyins  ,uaiuies  and  di^18^ 88  8 «■«!« 

' = ==» 
3-3. 1 CONTROL  LAW  SIMULATION 

"odlfied  to  lnclude  a^a»1- 
tion.  The  cockpit  was  fitted  with  a 1 2?  f !’  W3S  utilized  for  this  simula- 
right  side  of  the  slat  tfc^Si?  f a*?'*?*  SSC  "“ached  to  the 

conventional  pilot  displays  such  as  t-h  atvi^  i”?  Uded  3 flxed  reticle  HUD  and  the 

of-the-windcw  displays  changed  as  required  ^“provLTlo^miTSe oil' ' IT  T' 
landing . 8ir~t0~adr  co-bat,  air-to-ground  weapoL  dolive^,  ^^a'rl^f  t TrAT^’ 

equations  in^lx^degre^s-of-f IeedImTeSl8ted  T 8 °f  non“lln“r  differential 

Tih11  ---- l^igir^i-^r 

3.3. 1,2  Simulation  Methods  and  Results  - The  etwoifio  , , , 

Simulation  wre  the  evaluatio"  anlTefinlmeTt  irEeTrcT^Tr.^ ‘T  T""01  l“ 
Emphasis  was  placed  on  Improvements  in  weaoon  H.H  CS’  pilot  asslst  “odes, 
realized  with  multimode  controls t ^deteLioed 7*  aCCUfaCy  that  C°“ld  be 

and  quantitative  measurement  of  the  effectiveness  aiiTvortl  S Pll0t  oplnion 
described  in  Section  2 The  Mini  n -t  ^ , and  worxload  parameters  as 

Simulation  were:  pilot-assist  modes  evaluated  during  the  Control  Law 


o 


Normal  Mode 

Fixed  Canards  Mode 
Manual  Carrier  Landing  Mode 
DigiPACT  Mode 


o Air-to-Air  Combat  Mode 
o Air  Combat  Mode  (ACM) 

0 Air-to-Ground  Gunnery  Mode 
o Air-to-Ground  Bombing  Mode 


det.rSLNSin^^5™^d^^i«^c^i^f^^1,,®  M°deS  evalu8':8d  t0 

trol  laws  to  ef fect^improvement^in^ilo^ratingl^^these  SET*  “ 

creasing  delJry  ”°deS  dir88t8d  8t  1 

mance  of  the  weapons  delivery  mission  segment^  Each  ft 1 ”°rtl°ad  durln8  the  I’erfo 
with  the  appropriate  weapon  delivery  mod?  SL^S  STSS^ThST 
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MCAIR,  Air  Force,  Marine  and  Navy  pilots  participated  in  the  Control  Law  Simu- 
lation with  the  MCAIR  pilots  completing  the  initial  evaluations  and  refinements, 
and  the  customer  pilots  participating  in  the  final  evaluation  from  30  September 
through  11  October  1974.  Each  customer  pilot  participated  in  the  simulation  for 
one  week.  The  week  began  with  a briefing  on  the  control  laws  and  followed  with 
familiarisation  sessions  on  the  simulator.  At  mid-week,  effectiveness  and  workload 
data  were  recorded  and  an  informal  debriefing  held  during  which  the  evaluation 
pilots  suggested  modifications  they  wished  to  evaluate  to  improve  effectiveness  and 
handling  qualities.  Those  modifications  which  could  be  readily  implemented  during 
the  simulation  evaluation,  or  which  could  be  implemented  on  an  overnight  basis  were 
evaluated  on  Thursday  and  Friday,  and  a final  set  of  effectiveness  and  workload  data 
were  recorded.  A formal  debriefing  was  held  on  Friday. 

The  pilots  felt  that  a significant  learning  curve  existed  which  greatly 
influenced  pilot  proficiency  and  that  after  one  week  of  simulation  only  a minimum 
proficiency  level  was  attained.  However,  basic  aircraft  control  improved  on  a 
session-by-session  basis,  allowing  for  a more  critical  analysis  and  evaluation  near 
the  end  of  each  week.  All  pilots  agreed  that  the  concept  of  multimodes  is  viable 
and  results  in  increased  mission  effectiveness.  A thorough  evaluation  of  these 
modes  was  hindered  by  excessive  roll  sensitivity  in  all  modes  and  insufficient 
adjustability  of  the  side  stick  controller.  In  an  attempt  to  lessen  these  problems, 
combinations  of  the  following  modifications  were  incorporated  into  the  system  for 
further  evaluation  during  the  latter  part  of  each  weeks 


o Increased  lateral  SSC  breakout  forces, 
o Reduced  lateral  prefilter  gain, 
o Reshaped  lateral  stick  shaping  curve,  and 
o Reduced  lateral  prefilter  time  constant. 


These  modifications  provided  a noticeable  improvement  in  both  the  handling  qualities 
and  the  weapons  delivery  effectiveness,  but  the  pilots  believed  that  further 
improvement  could  be  obtained.  A general  pilot  consensus  was  that  a wider  range  of 
adjustability  afforded  to  the  armrests  and  the  stick  and  throttle  assemblies  would 
increase  controllability  and  improve  the  handling  qualities.  These  modifications 
could  not  be  performed  within  the  schedule  available  for  the  Control  Law  Simulation, 
however,  they  were  performed  later. 

Two  separate  modes,  the  Air-to-Air  Combat  Mode  and  the  Air  Combat  Mode  (ACM), 
were  developed  and  evaluated  for  the  air-to-air  mission  segment.  All  of  the  evalua- 
tion pilots  felt  that  the  ACM  provided  better  tracking  in  the  air-to-air  mission 
segment  than  the  Air-to-Air  Combat  Mode.  Consequently,  the  Air-to-Air  Combat  Mode 
was  dropped  from  further  consideration. 

The  special  features  of  DLC,  Lateral  Translation  and  Flat  Turn  integral  to  the 
air-to-ground  weapons  delivery  modes,  were  considered  assets  to  the  weapons  delivery 
solution.  The  DLC,  however,  produced  only  a slight  effect  on  aircraft  flight  path. 
In  response  to  the  pilot's  request  for  more  DLC  authority,  the  ailerons  and  spoilers 
were  programmed  to  assist  the  canards  and  stabilator  for  producing  direct  lift. 

This  modification  was  incorporated  into  the  control  laws  between  simulations  and 
evaluated  during  the  Integrated  Control  Law  and  Display  Simulation  discussed  in 
Section  3.3.3. 
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3*3.2  DYNAMIC  DISPLAY  SIMULATION  - Dynamic  Display  Simulations  were  conducted  on 
the  Information  Display  Incorporated  Input  Output  Machine,  (IDIIOM).  The  initial 
set  of  symbology  and  formats,  established  by  analysis,  was  programmed  into  the  IDIIOM 
for  review  and  evaluation.  Special  purpose  programs  were  used  which  permitted  con- 
trolling the  individual  symbols  from  the  IDIIOM  keyboard.  Also  a digital  replayable 
tape  was  made  which  was  played  through  the  IDIIOM  to  demonstrate  HUD  and  MFD  I 
symbology  and  formats  under  dynamic  conditions. 

As  a result  of  the  dynamic  display  simulation,  some  changes  were  made  to  the 
symbology  and  the  alphanumeric  window  allocations  were  redefined.  Switching  logic 
was  then  developed  which  provided  the  appropriate  display  presentation  automatically 
with  the  selection  of  a flight  control  mode. 

Figure  79  shows  some  flight  control  mode-related  displays  presented  on 
the  HUD.  Figure  SO  shows  a flight  control  mode  related  display  presented  on  the 
MFD  I.  Figure  81  shows  display  formats  and  symbology  such  as  presented  on  the 
MFD  II. 


Figure  79 

Flight  Control  Mode  Related  Displays 
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Figure  80 

MFD  I Display  Format  for  Normal  Mode 
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Figure  81 

MFD  II  Format  and  Symbology 
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MEAN  TIME 


INTEGRATED  CONTROL  LAW  AND  DISPLAY  SIMULATION 


3. 3. 3.1  Simulation  Setup  - The  Integrated  Control  Law  and  Display  Simulation 
utilized  the  Manned  Air  Combat  Simulator  (MACS)  III.  The  MACS  III  is  a fixed-base, 
real  time  simulator  enclosed  in  a 40-foot . diameter  spherical  dome  which  is  used 
as  a projection  screen  for  out-of-the-window  displays.  T'he  -out^-Of-the-window 
displays  included  a horizon,  aircraft  carrier,  target  aircraft  for  air-to-air 
combat  and  runway  used  for  air-to-ground  weapon  delivery  and  takeoff  and  landing. 
The  cockpit  included  a- HUD,  MFD  I,  MFD  II,  Computer  and  Display  Controller,  armrest 
mounted  throttles  and  SSC  arranged  as  described  in  Figure  82.  The  basic  airframe 
math  model  was  the  same  as  that  employed  in  the  Control  Law  Simulation  with  the 
addition  of  math  models  of  the  actuators  which  were  flight  hardware  in  the  SFCS 
Flight  Simulator. 
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Instruments 


Computer 
and  Display 
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Map 
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Primary  Flight 
Controller 


Figure  82 

Cockpit  Arrangement  of  Mode  Related  Displays  and  Controllers 


Major  changes  made  to  the  control  laws  and  controllers  since  the  Control  Law 
Simulation  were: 


Replacement  of  the  modified  SFCS  base-pivot  SSC  with  a laboratory-model 
palm-pivot  SSC, 


o Increased  adjustability  for  the  throttles,  SSC,  and  controller  armrests 


o Desensitization  of  the  lateral  control 


o Addition  of  symmetrical  ailerons  and  spoilers  to  the  DLC,  and 


o Elimination  of  the  Air-to-Air  Combat  Mode 


3. 3. 3. 2 Simulation  Methods  and  Results  - The  objectives  of  the  Integrated  Control 
Law  and  Display  Simulation  were  those  objectives  stated  in  Section  3.3.  These 
objectives  were  realized  through  the  performance  of  individual  mission  segments  and 
the  complete  mission  scenario  utilizing  all  control  modes  and  related  displays 
except  for  Automatic  ILS  and  Automatic  Energy  Management  which  were  not  evaluated 
during  these  man-in-the-loop  simulations.  The  DFCS  Mission  Scenario  - Mission 
Flight  Plan  used  during  the  simulation  is  shown  in  Figure  83. 
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Three  Air  Force,  one  Marine,  two  Navy  and  one  civilian  in  addition  to  MCAIR 
p lots  participated  in  the  simulation.  The  customer  pilot  evaluations  were  con- 
ducted in  three,  one-week  periods  between  9 December  1974  and  17  January  1975.  The 
simulation  was  conducted  in  a manner  similar  to  the  Control  Law  Simulation  with  each 
pilot  participating  in  the  simulation  for  one  week  which  included  periods  of  brief- 
ings, familiarization  sessions  on  the  simulator,  data  taking  sessions  and  debrief- 
ings. Three  of  the  seven  customer  pilots  had  also  participated  in  the  earlier 
Control  Law  Simulation. 

The  pilots  felt  that  the  basic  DFCS  concept  of  multimodes  and  related  displays 
was  shown  to  increase  effectiveness  and  reduce  workload  although  the  problem  of 
lateral  sensitivity  had  not  been  completely  eliminated  in  this  simulation. 

Two  of  three  pilots  who  participated  in  both  the  Control  Law  and  the  Integrated 
Control  Law  and  Display  Simulations  felt  that  the  laboratory-model  palm-pivot  SSC 
was  an  improvement  over  the  modified  SFCS  base-pivot  SSC  used  in  the  Control  Law 
Simulation,  and  that  they  could  track  better  with  it.  However,  these  pilots  did  not 
have  the  opportunity  to  use  the  modified  base-pivot  SSC  with  its  greater  range  of 
adjustability.  Three  other  pilots,  including  one  who  had  participated  in  the  Con- 
trol Law  Simulation,  had  difficulty  controlling  the  aircraft  and  tracking  a target 
in  the  air-to-air  mission  segment  with  the  laboratory-model  palm-pivot  SSC.  On  the 
last  day  of  the  simulation,  these  pilots  were  given  the  opportunity  to  track  with 
the  SFCS  base-pivot  SSC.  Statistical  tracking  data  were  not  recorded  for  these 
evaluations,  but  the  tracking  was  visually  observed  to  be  significantly  improved 
with  the  base  pivot  SSC,  and  the  pilots  stated  their  preference  for  the  base-pivot 
SSC  in  the  final  debriefing  session. 

The  paraphrased  comments  of  the  majority  of  the  evaluation  pilots  relative  to 
the  control  modes,  displays,  primary  flight  controllers  and  displays,  and  controller 
management  are  listed  in  Figure  84. 

3*3*^  CONCLUSIONS  - Several  conclusions  can  be  drawn  from  these  simulations: 

o The  integration  of  multimodes  and  related  displays  increases  effectiveness 
and  reduces  workload, 

o Pilots  will  accept  changes  in  aircraft  response,  controller  functions  and 
displays  when  these  changes  contribute  to  increased  mission  effectiveness 
and  reduced  workload,  and 

o The  basic  DFCS  concepts  of  multimode  control  laws  and  related  displays  are 
sound  and  should  be  pursued  in  a flight  test  program. 
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Control  Modes 

• Multimode  Control  is  a Viable  Concept  and  can  Result  in  Increased  Mission  Effectiveness 

• Manual  Carrier  Landing  Mode  Could  Also  be  Used  for  Field  Landing 

• Air-to-Ground  Bombing  Mode  "Super"  with  Lateral  Translation  and  Flat  Turn 

• Air-to-Ground  Bombing  and  Air-to-Ground  Gunnery  Could  be  Combined  into  a Single  Air-to-Ground  Mode 

• Neutral  Speed  Stability  Provided  with  the  Pilot-Assist  Modes  was  Very  Desirable 

• Flat  Turn  { Fuselage  Aiming)  Should  be  Added  to  the  Air-to- Air  Combat  Mode 

• A Statically  Unstable  Advanced  FBW  Aircraft  Needs  Angle-of-Attack  Limiting  for  Stall  Prevention 

• A Departure  Preventer  is  not  Wanted  in  the  Power  Approach  Configuration,  Would  Rather  Power  Out  of  a Stall 
than  have  the  Aircraft  Automatically  Rotete  Nose-Down  when  Close  to  the  Surface 

• Preselect  Heading  is  "Great" 

• Pilot-Relief  Modes  Alleviate  Workload 

• Pilot-Relief  Modes  are  Desirable  in  Cross  Country  and  in  Controlled  Airspace 

• Automatic  Navigation  Would  be  Very  Useful  for  Reconnaissance 

• Maneuvering  Ability  Needs  to  be  Increesed  in  Automatic  Navigation  Mode 

• Automatic  Energy  Management  is  Desirable 

Displays 

• Vertical  Arrangement  of  HUD  and  Multi-Function  Displays  is  Satisfactory 

• Weapon  Delivery  Displays  were  Very  Good  Except  that  the  HUD  Air-to-Ground  Bombing  Automatic-Display  was 
too  Complex 

• HUD  Information  Content  and  Large  Instantaneous  Field-of-View  were  Excellent 

• Degree  of  Display  Declutter  is  Adequate 

• Vertical  Velocity  Should  Remain  on  the  HUD  During  Cruise 

• The  EADI  Presentation  Needs  Additional  Cues  to  Readily  Determine  Attitude  During  Gross  Maneuvers 

• Area-Nevigetion  Map  Display  and  Automatic-Navigation  Capability  are  Good  Concepts 

• Minor  Symbology  Chenges  ere  Desirable 

Primary  Flight  Controllers 

• Location  of  the  SSC  and  Throttles  was  Satisfactory 

• In  General,  the  Switches  and  Buttons  on  the  Throttle  were  well  Located  Except  that  the  Reech  to  the  Air-to-Air 
Combat  Mode  Select  Button  was  too  Long 

• Throttle  Grips  ere  too  Massive 

• Short  Throw  Throttles  were  Satisfactory  in  Simulation  but  Should  be  Evaluated  in  Flight 

• Provisions  for  Up  and  Down  Adjustment  with  the  Seat  and  Adjustable  Arm  Rests  ere  Needed  with  Side-Mounted 
Controllers 

• Side  Stick  Controller  Mechanization,  e.g.,  Grip  Shape,  Travels  and  Breakout  Forces,  Needs  Improvement 

Display  and  Controller  Management 

• CDC  Location  is  Satisfactory 

• The  Concept  of  Simultaneous  Selection  of  Flight  Control  Mode  end  Related  Display  is  "Super" 

• The  Selection  of  Air-to-Air  Combat  Mode  with  a Switch  on  the  Throttle  Grip  is  "Great" 

• The  CDC  Concept  is  Outstanding  and  its  Operation  is  Easy  to  Leern 

• The  CDC  Displey  Update  Rete  Needs  to  be  Increased 

• Some  Changes  in  System  Logic  are  Desirable,  e.g., 

• Selection  of  Normal  end  Attitude  Hold  Modes  vie  the  CDC  Should  be  Accomplished  Using  the  CDC  Line  Select  Keys 

• Lateral  Autometic  Navigation  Mode  Should  Remain  Engaged  During  SSC  Pitch  Corrections 

• Completed  Portion  of  the  Flight  Plen  Should  not  be  Erased 

Figure  84 

Evaluation  Pilots  Comments 
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4.1  GENERAL 


4.0  ADVANCED  DEVELOPMENT  PROGRAM  (ADP)  DEFINITION 


1 

1 


This  section  is  a summary  of  the  recommended  Digital  FCS  ADP  Definition.  The 
recommended  ADP  Definition  evolved  from  the  analyses  and  simulations  reported  in 
Sections  2.0  and  3.0  of  this  report. 

4.2  CANDIDATE  FLIGHT  CONTROL  CONFIGURATION 

The  flight  control  configuration  recommended  for  the  ADP  is  a triplex  arrange- 
ment employing  cross-channel  monitoring  for  detection  of  the  first  failure  and 
in-line  monitoring  for  detection  of  the  second  failure. 

The  configurations  which  were  evaluated  in  arriving  at  this  recommendation 
are  shown  in  Figure  85.  A summary  of  the  results  of  the  analyses  conducted  prior 
to  selection  of  the  Triplex  Configuration  is  presented  in  Table  35. 


Three  Sound  Candidates 


Figure  85 

Configuration  Development 


Table  35 

Three  Sound  Candidates 
Summary  of  Analyses 


Configuration 

Performance, 
Safety  and 
Survivability 

Rat lability 
(Probability 
of  Loss  of 
Control) 

Maintainability 

(MMH/FH) 

Relative 

Weight 

Relative 

Cost 

A 

(3-3-3) 

Sama 

3.5  x 10-8 

0.262 

1.00 

1.00 

B 

(4-34) 

Same 

2.3  x IQ-9 

0.298 

1.18 

1.35 

C 

(444) 

Same 

3.9  x 10_1° 

0.309 

1.18 

1.42 

i 


4.2.1  SURVIVABLE  FLIGHT  CONTROL  SYSTEM  (SFCS)  BACK-UP  PROVISIONS  - It  is  planned 
that  the  quadruplex  SFCS,  which  is  currently  installed  in  F4  S/N  62-12200  will  be 
used  as  a safety  back-up  for  initial  flights.  The  planned  arrangement  of  the  SFCS 
and  Digital  FCS  is  illustrated  in  Figure  86. 


The  arrangement  of  the  SFCS  and  Digital  FCS  is  analogous  to  the  arrangement 
of  the  mechanical  back-up  system  and  SFCS  which  was  successfully  used  in  Phase  IIA 
of  the  SFCS  Flight  Test  Program.  The  Analog  Isolation  Mechanism  (AIM),  is  a device 
similar  to  the  one  which  was  used  in  the  SFCS  Program.  In  the  SFCS  Program  it  was 
called  a "Mechanical  Isolation  Mechanism"  and  it  is  described  in  Section  22b. (3) 
Page  137  of  Report  AFFDL-TR-71-20  (SFCS  Interim  Report).  It  is  planned  that  one 
AIM  will  be  used  in  series  with  the  stabilator  surface  actuator  and  another  in 
series  with  the  rudder  surface  actuator.  The  ailerons  will  be  controlled  only  by 
the  Digital  FCS.  This  arrangement  is  also  analogous  to  the  SFCS  Phase  IIA  arrange- 
ment wherein  the  ailerons  were  Fly-By-Wire  without  mechanical  back-up. 

After  the  Digital  FCS  has  been  evaluated  in  flight  and  found  to  be  safe,  it 
is  planned  that  the  SFCS  will  be  removed  or  disabled. 

4.2.2  SALIENT  FEATURES  OF  DIGITAL  FCS  - Salient  features  which  are  planned  for 
implementation  in  the  ADP  are  listed  in  Figure  87. 

4.2.3  FLIGHT  CONTROL  MODES  - The  pilot-assist  modes  planned  for  the  ADP  are 
listed  in  Figure  88.  Features  of  the  Normal  Mode  are  summarized  in  Figure  89. 
Features  of  the  Air-to-Air  Combat  Mode  are  summarized  in  Figure  90.  Features  of 
the  air-to-ground  modes  are  summarized  in  Figure  91.  The  pilot-relief  modes 
recommended  for  the  ADP  and  other  available  options  are  presented  in  Figure  92. 
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• Software  Voting  at  Sensor  Inputs  and  Secondary  Actuator  Commands 

• Comparison  Monitored  for  First  Failure 

• In-Line  Monitored  for  Second  Failure 

• Actuators  Monitored  in  Software  for  First  and  Second  Failure 

• Outerloop  Sensors  Tested  by  Data  Reasonableness 

• Analog  Servo  Loop  Closure 

• DMA  Data  Exchange  Between  Digital  Flight  Control  Computers 

• Digital  Flight  Control  Computers 

— Frame  Synchronized 

— Have  Dedicated  Power  Supplies 

— Self-Tested 

• The  Emergency  Disengage  (Paddle)  Switch  Deenergizes  the  Canard  Shutoff  Valves 

• Sensors  are  not  Dispersed 

• Normal  Mode  Selection  will  have  Priority  Over  any  Other  Mode 

• For  Initial  Flights  with  SFCS  Backup: 

— Longitudinal  and  Directional  Axes  use  Analog  Isolation  Mechanisms  (AIM) 

— The  Emergency  Disengage  (Paddle)  Switch  Causes  the  AIM's  to  Shift  to  the  Analog  Mode 

— No  Canard  Operation  in  the  SFCS  Backup  Mode 

— A Modified  SFCS  Master  Control  and  Display  Panel  (MCDP)  will  be  Located  in  a 
Remote  Location 

— A Small  Cockpit  Mounted  Panel  which  Includes  the  MCDP  Switch  and  Indicator 
Functions  will  be  Provided 

Figure  87 

Salient  Features  of  the  Triplex  Digital  Flight  Control  System 


Evaluated  During 
Man-in-the-Loop  Simulations 

• Normal 

• Gear  Up:  Cruise 

• Gear  Down:  Airfield  Takeoff 
and  Landing 

• Carrier  Takeoff  and  Landing 

• Air-to-Air  Combat 

• With  Planar  Turn 

• Without  Planar  Turn 

• Air-to-Ground  Bombing 

• Air-to-Ground  Gunnery 

• Fixed  Canards 

• DigiPACT<2) 

^ includes  Operable  and  Fixed  Canards 

(2)DigiPACT  - Digital  Implementation  of  SFCS 
(Provided  for  Purposes  of  Comparison) 


Recommended  for 
Incorporation  Into  ADP 

Normal^) 

• Gear  Up:  Cruise 

• Gear  Down:  Airfield  and  Carrier 
Takeoff  and  Landing 


Air-to-Air  Combat 


• Without  Planar  Turn 
Air-to-Ground  Bombing 
Air-to-Ground  Gunnery 


DigiPACT<2) 


-PACT  Control  Laws 


Figure  88 

Pilot-Assist  Modes  for  the  ADP 


I 1 f 

K l 
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Gear  Up  Gear  Down 


• Neutral  Speed  Stability 

• Neutral  Speed  Stability 

(Disengaged  on  Landing) 

• Direct  Lift  Control^ ) 

• Direct  Lift  Control 

• Lateral  Translation^) 

• Lateral  Translation 

• Blended  Pitch  Rate  and  Nz 

• Blended  Pitch  Rate,  Nz  and 

(C*)  Feedback 

AOA  Feedback 

• Turn  Coordination  Using  P a and  ARI 

• Turn  Coordination  with  ARI 

• Departure  Prevention 

• Departure  Prevention 

(^Optimized  for  the  Air  Refueling  Segment 

Figure  89 

Features  of  Normal  Mode 


• Neutral  Speed  Stability 

• Vertical  Fuselage  Aiming  using  the  Direct  Lift  Controller 

• Lateral  Fuselage  Aiming  using  the  Rudder  Pedals 

• Increased  Pitch  and  Roll  Response 

• Departure  Prevention 

• Improved  High  Angle-of-Attack  Performance 

• Blended  Pitch  Rate  and  Nz  Feedback  at  Low  and  Medium  AOA 

• Blended  Pitch  Rate  and  AOA  Feedback  at  High  AOA 

• Turn  Coordination 

- ARI 

— 0 and  (3  Feedback 

Figure  90 

Features  of  Air-to-Air  Combat  Mode 

• Neutral  Speed  Stability 

• Direct  Lift  Control 

• Lateral  Translation 

• Flat  Turn 

• Precise  Attitude  Tracking  - Pitch  Rate  Feedback  Only  in  the 
Longitudinal  Axis 

• Longitudinal  Axis  Reconfigured  to  Include  Nz  Feedback  above 
One  g Incremental  Load  Factor 

• Gun  Reticle  or  Velocity  Vector  Stabilized  Depending  on 
Weapon  Selection 

• Departure  Prevention 

Figure  91 

Features  of  Air-to-Ground  Modes 
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• Recommended  for  ADP 

• Pitch  Attitude  Hold 

• Roll  Attitude  or  Heading  Hold 

• Altitude  Hold 

• Preselect  Heading 

• Automatic  Vertical  Navigation 

• Automatic  Lateral  Navigation 


• Available  Options  for  ADP 

• Automatic  Carrier  Landing 

• Automatic  ILS 

• Automatic  Throttles 

• Automatic  Energy  Management 


Figure  92 
Pilot-Relief  Modes 


4.2.4  CONCLUSION  - A recommended  Digital  FCS  flight  control  configuration  has  been 
determined  as  summarized  above.  The  configuration  incorporates  the  features  deter- 
mined to  be  necessary  or  desirable  to  implement  the  conclusions  of  the  Digital  FCS 
Analyses  and  Simulations. 

4 . 3 COMPUTER  SELECTION 


An  investigation  of  guideline  computer  characteristics  was  conducted  to  aid  in 
selection  of  an  airborne  digital  flight  control  computer  suitable  to  implement  the 
recommended  Digital  FCS  ADP  configuration.  The  guideline  characteristics,  given 
in  Figure  93,  are  a useful  guide  in  selecting  the  candidate  computers. 

• Status 

• Flight  Worthy  and  Near  Production,  Preferably  Used  in  DFCS  Related  Applications 

• Support  Software  and  Equipment 

• Developed  and  Available;  Minimum:  Assembler,  Simulator,  Loader-Verifier,  Control  Unit 

• Environment 

• MIL-E-5400,  Class  2 Minimum  (SC  to  70,000ft,  -54°  to  +71°C) 

• Type 

• General  Purpose,  16-BIT  Parallel,  Microprogram  Control 

• Arithmetic 

• Fixed  Point,  Binary,  Two's  Complement,  Double  Precision 

• Storage 

• 24K  x 16-BIT  Core  for  Use  During  Ground  Development  and  Flight  Tests  with  Backup 

• 24K  x 16-BIT  Prom  + IK  x 16-BIT  Ram  for  Use  During  Flight  Tests  without  Backup 

• 1-Bit  Parity 

• Instructions 

• 43  Basic,  Including  Double  Precision  Load,  Store,  Add,  Subtract,  Shift, 

• Execution  Times 

• 2 microsecond  Add;  7 microsecond  Multiply 

• Computational  Speed 

• 200,000  Operations  per  Second 

• Interrupts 

• 13  Priority  Levels 

• Registers 

• 16  x 1 6-BIT  Register  File,  Two  of  Which  can  be  used  as  Index  Registers 

• Timers 

• 2 Programmable  Timers,  1 Watchdog  Timer 

• Input-Output 

• Program  Controlled  Input  and  Output 

• One  DME  Input  Channel 

• Two  Input  and  Output  DME  Channels 

• 16  Input  and  Output  Discretes 

• 17-Bit  Words  Including  Parity 

• Volume:  0.390  cu  ft  (Ave  with  Core) 

• Weight:  23  lb  (Ave  with  Core) 

• Power:  160  W (Ave  with  Core) 


Figure  93 

Guideline  Characteristics  for  ADP  Computers 
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Thirty-five  computers  were  then  surveyed  and  their  characteristics  compiled. 
The  information  on  some  computers  was  more  complete  than  on  others;  however,  an 
attempt  was  made  to  place  all  computers  on  a common  basis  with  respect  to  type  and 
size  of  memory  before  preparing  weight,  size  and  power  summaries. 

Four  candidate  computers  were  then  selected  from  the  field  of  surveyed 
computers . 

Conclusions 


o The  computers  surveyed  all  fell  rather  neatly  into  three  weight,  volume, 
and  power  classes,  named  Maxi,  Midi,  and  Mini,  shown  in  Tables  36,  37,  and 
38,  respectively. 

o There  is  at  least  an  approximate  correlation  between  the  weight,  volume, 
and  power  classes,  and  availability,  cost,  and  computational  power 
(throughput) . Figure  94  shows  the  three  classes  of  computers  versus  the 
years  in  which  the  computers  would  likely  be  selected  for  use  in  a Digital 
FCS  ADP.  Figure  95  shows  the  relative  cost  and  throughput  and  the  expected 
region  of  operation  for  the  Digital  FCS. 

o The  characteristics  of  the  four  candidate  computers  are  given  in  Tables  39 
and  40.  The  guideline  characteristics  are  included  for  purposes  of 
comparison. 

o The  candidate  computers  when  configured  with  a 24K  memory,  fall  in  the 
middle  to  upper  region  of  the  Midi  class. 

o The  candidate  computers  can  also  be  configured  with  semiconductor  memories. 
When  so  configured,  they  fall  in  the  lower  region  of  the  Midi  class. 


Table  36 

Computer  Selection 
Computers  Surveyed 


"Maxi"  Class 
35  to  60  lb 


Computer 

Weight* 

Ub) 

Volume* 

(ft3) 

Power* 

(W) 

Singer  SKC-2000 

36.0 

0.613 

355 

G.E.  MCP-701 

54.0 

1.070 

380 

Control  Data  CDC-5400B 

58.0 

1.034 

300 

IBM  AP-1 

44.5 

0.693 

220 

IBM  CP-2 

51.0 

0.917 

270 

IBM  AP-101 

48.0 

1.049 

350 

Sperry  1819A 

52.0 

0.957 

250 

Texas  Instruments  2540A-2 

49.0 

1.013 

245 

Average 

49.0 

0.920 

296 

‘Based  on  24 K x 16  BIT  Core  Memory 
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Table  37 

Computer  Selection 
Computers  Surveyed 
"Midi"  Class 
15  to  30  Lb 


Computer 


Weight*  Volume* 


Autonetics  D216 
Autonetics  D1216 
Bendix  BDX-910 
Teledyne  TDY-43 
Texas  Instruments  2520-2 
Texas  Instruments  2520-X 
Delco  Magic  III 
IBM  SP-1 

G.E.  MCP-701A  (Semiconductor) 

Sperry  1819B 

Sperry  RMM-1 

Honeywell  H DC-301  A 

General  Electric  CP- 16 

Control  Data  CDC-5400B  (Thin  Film) 

Control  Data  CDC-469 

Litton  Spirit  - II 


Average 


Based  on  24K  core  memory  except  as 


0.517 

0.347 

0.380 

0.437 

0.480 

0.145 

0.397 


23.0  0.390 


Table  38 

Computer  Selection 
Computers  Surveyed 
"Mini"  Class 
Less  Than  10  Lb 


Power* 

(W) 


130 

130 

230 

180 

120 

120 

168 

147 

50 

180 

195 

120 

170 

50 

160 

180 


noted  in  parentheses. 


Computer 

Weight* 

(lb) 

Volume* 

(ft3) 

Power* 

(W) 

Singer  SKC-3000 

7.50 

0.1840 

72.0 

Singer  SKC-2000 

8.20 

0.2000 

87.0 

Bunker-Ramo  BR-1018 

5.00 

0.0500 

50.0 

Lear-Siegler  Astro  1601 

? 

? 

? 

Hughes  HDP-4 

6.00 

0.0985 

50.0 

IBM  SP-OA 

7.26 

0.0555 

81.0 

Delco  Magic  HI  (Model  362) 

8.30 

0.1250 

60.0 

Delco  Magic  HI 

4.20 

0.0810 

29.0 

Bendix  BDX-910 

3.90 

0.0990 

32.5 

Autonetics  DM  216 

4.90 

0.0610 

44.0 

Honeywell  HDC-301A 

7.80 

0.1560 

51.0 

Average 

6.30 

0.1100 

56.0 

I 


'Based  on  a 16K  Semiconductor  Memory;  Includes  CPU,  I/O,  and  Power  Supply;  Does 
Not  Include  Separate  Enclosure 
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Maxi  Class 

Average  (24K  Core  Memory) 
Weight  49  lb 
Volume  0.92  ft3 
Power  296  W 


Classes 

Average  (24K  Core) 
Weight  23  lb 
Volume  0.390  ft3 
Slower  160 


Mini  Class 

Average  (16K  Semiconductor): 
Weight  6.3  lb 
Volume  0.1 10  ft3 
Power  56  W 


Year  of  ADP  Start 

Figure  94 

Airborne  Computer  Trends 

Weight,  Volume,  Power 


Relative 


Estimated  Region 
for  Digital  FCS  ADP 


Throughput  (kops) 


Figure  95 

Airborne  Computer  Trends 
Relative  Cost  vs  Throughput 


Table  39 

Candidate  Computers 


Status 
Control 
Wood  Length 

• Instruction 

• Dete 
Storage 

• Cora 

• Semiconductor 

• Parity 
Instructions 
Execution  Times 

• Add 

• Multiply 
Interrupts 
Registers 

Timers 

Input  • Output 


Based  on  2K  Ram  and  24K  Rom 


Guideline  Characteristics 

Flight  Worthy  and  Near  Production 
Micro  Program 

16  BIT 
16  BIT 


24  K x 16  BIT 

24  K x 16  Prom,  1 K x 16  Ram 
1 - BIT 
43  Basic 

2 Microseconds 
7 Microseconds 
13 

16  x 16  BIT  Fila 
Incl  2 Index 
2 Programmable 
1 Watch  Dog 

Programmed  Controlled  Input-Output 
One  DMA  Input  Chennai 
Two  DMA  Input  - Output  Channels 
16  Input  and  Output  Discrates 
17-BIT  Works  Including  Parity 
0.390  cu  ft  (Ava  with  Corel 
23  lb  (Ava  with  Core) 

160  W (Axe  with  Corel 


Honeywall  qj: 

HDC  ■ 301A MCP  701A 

SAAB  JA-37,  A7  Multimoda  701  Used  on  HLH  and  Dot  727 
Hardwired  Microprogram 


24  K x 16 
24  K and  1 K 
No 

47 


1 

No 

Yas 

No 

One 

12  Input,  10  Output 
No  Parity 
0.380 
28 

120 


24  K x 16 
24  K and  2 K 
Ram  has  Parity 

104  + 24  Application  Dapendent 

1.75 

5.4 

13  Plus 

3 Index  Plus  256  Word 
Dedicated  Ram  Scratch  Pad 
1 
1 

Yas 

Yes 

Yas 

9 Input,  9 Output 
Yas 
0.300* 

18* 

50* 


AMi  TW0'5  C°mPh""M’  MIL  E M0°'  E ^ironment. 


Table  40 

Candidate  Computers 


Control 
Word  Length 

• Instruction 

• Data 
Storage 

• Cora 

• Semiconductor 

• Parity 
Instructions 
Execution  Times 

• Add 

• Multiply 
Interrupts 
Registers 

Timers 

Input  - Output 


Volume 

Weight 

Power 


Guideline  Characteristics 

T.l. 

2520-X 

Taledyna 
TDY  43 

Flight  Worthy  and  Near  Production 

HARM,  F 15  TEWS 

MBB  DFCS 

Micro  Program 

Yas 

Yes 

16  - BIT 

16 

16  (20  and  24) 
Availabla 

16  - BIT 

16  end  32 

16 

24  K x 16  BIT 

24  K x 16 

24  K x 16 

24-K  X 16  Prom,  1 K x 16  Rem 

24  K and  1 K 

24  K end  1 K 

1 - BIT 

Yas 

1 BIT 

43  Besic 

30  Basic,  69  with  Extansions 

70 

2 Microseconds 

1 

2.67 

6.0 

7 Microseconds 

6 

13 

13 

16 

16x16  BIT  File 

16  x 16  BIT 

16  x 16  BIT 

2 Programmable 

1 

No 

6 Index 

1 Watch  Dog 

1 

Yes 

Multiport  DMA 

Programmed  Controlled  Input-Output 

One  DMA  Input  Channel 

No 

Two  DMA  Input-Output  Channels 

Availabla 

16  Input  end  Output  Discretes 

No 

16 

No  Parity 
0 507 

17-BI1  Words  Including  Parity 

No  Parity 

0.390  cu  ft  (Ave  with  Core) 

0.454 

231b  (Ave  with  Core) 

24 

160  W (Ave  with  Core) 

120 

180 

■ 1 ’ r vim,  Dinar 

Support  Software  end  Equipment  Available 


s 2 Environment, 


4.4  DISPLAYS  AND  CONTROLLERS 


The  display  and  controller  configuration  recommended  for  the  ADP  is  summarized 
in  this  section.  The  display  and  controller  block  diagram  is  presented  ^n  Fig- 
ure 96.  The  forward  cockpit  display  arrangement  is  presented  in  Figure  97. 

Salient  features  which  are  recommended  for  implementation  in  the  ADP  are  listed 
in  Figure  98. 


Figure  96 

ADP  Displays  and  Controllers 


4.5  DIGITAL  INTERFACE 

A Digital  Interface  (DIF)  Unit,  which  incorporates  all  of  the  functions 
to  implement  the  Digital  FCS  configuration  has  been  defined.  A summary  of  the 
functions  contained  in  the  DIF  is  presented  in  Figure  99.  As  illustrated  by 
Figures  86  and  96,  the  DIF  is  the  system  junction  box  which  interconnects  the 
system.  This  arrangement  is  convenient  for  purposes  of  conducting  BIT  and  IFIM 
tests  of  all  portions  of  this  system. 

4.6  MULTIPLEXING 

The  multiplexing  analysis  indicated  that  multiplexing  of  signals  between  the 
DIFs  and  the  redundant  sensors  and  actuators,  was  not  necessary  or  desirable. 
Multiplexing  between  the  display  and  flight  management  computers,  as  illustrated 
in  Figure  96,  was  determined  to  be  appropriate  in  order  to  provide  flexibility. 
The  recommended  characteristics  of  the  multiplexing  system  are  summarized  in 
Section  2. 8. 


166 


- . - ■ ■ - 


1 


****** 


Figure  97 

DFCS  Forward  Cockpit  Display  Arrangement 

• The  DFCS  Displays  will  be  Presented  on  Six  Cathode  Ray  Tube  (CRT)  Devices  as  Follows: 

- Head-up  Display  (HUD)_ 

- Three  Multifunction  Displays  (MFD  1,  MFD  II,  and  MFD  HI),  MFD  I and  II  in  the  Forward  Cockpit  and 
MFD  III  in  the  Rear  Cockpit,  and 

- Two  Computer  and  Display  Controllers  (CDC),  one  in  Forward  Cockpit  and  one  in  Rear  Cockpit. 

• Flight  Control  and  Display  Mode  Selection  may  be  Accomplished  by  Use  of: 

- Appropriate  Keys  on  the  Forward  or  Rear  Cockpit  CDC, 

- Dedicated  Switches  on  the  Backup  Control  Panel,  and 

- Dedicated  Switches  on  the  SSC  and  Throttles. 

• Displays  and  Controllers-to-Flight  Control  Interfaces  will  be  via  MUX  Bus(es)  and  Dedicated  Wires. 

• The  Flight  Control  System  Provides  only  Failure  and  Status  Information  to  the  Displays  and  Controllers. 

• Area  Navigation  will  be  Provided  Using  TACAN  and  INS  Information. 

• Existing  F-4  62-12200  Outer  Loop  Analog  Sensors  will  be  Used.  A to  D Conversion  will  be  Performed  in  the 
Flight  Management  Computer. 

• The  F-15  Digital  Computer  (CP-1075/AYK)  will  be  Used  without  Hardware  Change  and  is  Referred  to  as  the 
Display  Computer. 

• The  System  uses,  where  Practical,  Existing  Proven  Hardware,  Software,  and  Interfaces. 

• The  System  Provides  a Full  Complement  of  Displays  and  Controllers  for  Flight  Control  Mode  Evaluation. 

• The  HUD  will  Provide  Attack,  Navigation,  Situation,  and  Steering  Information  in  Symbolic  and 
Alphanumeric  Formats. 

• MFD  I will  Provide  EADI  and  Essential  Flight  Information  Redundant  to  that  Provided  on  the  HUD;  and,  in 
Addition,  will  Include  Radar  Displays  and  Provisions  for  TV-Format,  Raster-Scan  Presentations. 

• MFD  II  will  Provide,  Simultaneously,  Map  Display,  HSI  Symbolic  Display,  Digital  Parameters  Associated  with 
the  Navigational  Situation,  and  Threat  Evaluation  Data. 

• MFD  III  will  Provide  Data  Redundant  to  the  Data  Provided  on  MFD  I . 

Figure  98 

Salient  Features  of  the  Displays  and  Controllers 
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(A)  Power  Supplies  for  Sensors  and  Controllers 

• 28  VDC  to  + 15  VDC 

• 28  VDC  to  13  VAC  1800  Hz 

28  VAC  400  Hz 

(B)  Analog  to  Digital  Conversion 

• Scaling  and  Buffering 

• Parameter  Sample  and  Hold 

• A to  D Converters 

(C)  Digital  Data  Transfer 

• Data  Storage 

• Control  Data  Transfer  - Direct  Access 

• Display  Data  Transfer  ■ Multiplex  Bus 

(D)  Digital  to  Analog  Conversion 

• Control  Data  Storage  and  Decoding 

• D to  A Converters 

(E)  Actuator  Commands  - Control  Surfaces 

• Servo  Amplifiers 

• Feedback  Demodulators 

• AP  Demodulators 

(F)  Built-in-Test 

• IFIM 

• BIT  Stimuli 

Figure  99 

Functions  Contained  in  Digital  Interface  Unit  (DIF) 

4.7  FAULT  RECOGNITION  SCHEMES 

The  planned  fault- recognition  scheme  will  be  implemented  by  a combination  of 
cross-channel  and  in-line  monitoring.  It  is  planned  that  first  faults  will  be 
detected  using  cross-channel  monitoring  at  three  voting  planes  as  illustrated  in 
Figure  100.  It  is  planned  that  second  faults  will  be  detected  by  In-Line  Monitor- 
ing for  sensors,  transducers  and  actuators  and  computer  self-test  summarized  in 
Section  2.12. 


(^Voting  Plane  Locations 


Figure  100 

Cross-Channel  Monitoring  for  the  ADP 
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4.8  BIT  AND  IFIM 


Xt  is  Planned  that  a BIT  scheme  based  on  the  top  level  flow  diagram  presented 
in  Figure  39  will  be  implemented.  The  IFIM  will  be  designed  to  provide  fault 
coverage  as  indicated  by  Figure  47  wherein  it  is  illustrated  that  the  fault  cover- 
age required  depends  on  the  channel  failure  rate.  The  BIT  will  be  designed  to 
isolate  failures  to  an  LRU. 

4*9  SOFTWARE  MANAGEMENT  PLAN  AND  COMPUTER  MEMORY 

A detailed  software  management  plan  was  prepared  as  part  of  the  Digital  FCS 
efinition  Study.  It  is  planned  that  the  Software  Management  Plan  will  be  imple- 
mented in  the  ADP.  The  Development  Cycle  of  the  Operational  Program  is  illustrated 
in  Figure  101.  The  memory  required  for  the  display  computer  is  given  in  Table  41. 
The  memory  required  for  the  flight  management  computer  is  not  available  at  this 
time.  The  memory  required  for  each  flight  control  computer  is  given  in  Table  42. 


Major 

Tasks 

Definition 

Phase 

Design 

1 

Programming 

Acceptance  Phase 

Phase 

Phase 

System  Test  Phase 

Operation  Phase 

Problem  Specification 
Computer  Specification 

Software  Management  Plan 

Design  Specification 

Preparation  for  Change  Control 

Change  Control 

Preperation  for  Testing 

Support  Software  Planning 

Module  Design 

Follow  On 

Module  Coding  and  Test 

Follow  On 

Module  Integration 

Follow  On 

Coding  Specifications 

Follow  On 

Hardware  and  Software  Integration. 

1 

Iron-Bird  Tests 

Follow  On 

Installation  and  Pre-Flight  Tests 

Flight  Tests 

Acceptance  Tests 

/■ — 1 

* 

I : 

Major 

Milestones 


Compv-*er  Specification 
Software  Menage. .. -o',  rlan 


Acceptance  Test 
(Ground)  Report- 


Design  / / Pre-Flight  / 

Specification — ' / Test  ' 

Specifications 

Coding  Specifications 
Integration  Test  Specifications 
Iron-Bird  Test  Specifications 

Acceptance  Test  (Flight)  Report 

Figure  101 

Operational  Program  Development  Cycle 

Software  Development  Phases 


y 

/ 
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Table  41 

Memory  Requirements  for  Display  Computer 


Module 

Memory  Words 
(16  BITS) 

Executive 

840 

Data  Base 

2,600 

Subroutines 

740 

Self-Test 

820 

Navigation 

2,960 

Air-to-Ground 

2,630 

Air-to-Air 

3,660 

Flight  Director 

590 

Controls  and  Displays 

2,340 

Radar  Functions 

Total 

24,180 

Table  42 

Memory  Required  for  Flight  Control  Computers 


Function 


Control  Laws 
BIT 

Redundancy  Management  and/or  IFIM 
Executive 


Total 


Memory 

Triplex 


4,750 


13,850 


4.10  ELECTRICAL  SYSTEM 


A simplified  schematic  of  the  planned  Digital  FCS  electrical  system  is  presented 
in  Figure  102.  Features  of  this  arrangement  include: 


o Each  Digital  FCS  channel  bus  is  supplied  power  from  three  sources: 


o A dedicated  channel  Transformer-Rectifier  (T/R), 
o Crossfeed  from  one  other  channel  T/R,  and 
o The  SFCS  and  DFCS  Essential  Bus. 


o One  emergency  battery  capable  of  backing  up  any  or  all  channels. 


o All  crossfeed  circuits  have  diodes  and  limiters  for  fault-clearing  and 
isolation. 


o The  SFCS  and  DFCS  Essential  Bus  is  supplied  by  power  from 

o All  channel  T/Rs,  and 
o One  battery. 
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Figure  102 

Simplified  DFCS  Electrical  System  Schematic 
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4.11  CONTROL  SURFACE  IMPLEMENTATION 


FfS  Anp6^011^01  ?Ur!a?e  imPlementati°n  which  is  planned  to  be  used  in  the  Digital 
FCS  ADP  is  summarized  in  Table  43.  B 

Table  43 

Control  Surface  Implementation 


■ 

Stabilator 

U 

f — 
u 

/ X 

/ -A. 

Rudder 

~~ 

- 

u 

u 

u 

Differential  Ailerons  and  Spoilers 

u 

H 

u 

u 

Symmetrical  Ailerons  and  Spoilers 

u 

Differential  Horizontal  Canards 

u 

u 

Symmetrical  Horizontal  Canards 

u 

u 

U Uses 


4.12  LIGHTNING  PROTECTION  PLAN 

i The  lightning  protection  plan  for  the  ADP  is  summarized  in  Figure  103  The 
Plan  xncludes  aircraft  design  and  modification  provisions  intended ^to  contain 

v^ore  l SUr  ? °f  the  aircraft;  hardening  of  equipment  to  reduce  suscep- 
sur^  ? eq^Pment  to  transients  induced  by  lightning  current  flowing  on  the 
ace  of  the  aircraft;  and  a transient  analysis  lightning  susceptibility  test 
to  evaluate  the  protective  measures  employed. 


• Install  Lightning  Arrestors  on  External  Lights  and  Probes 

• Install  Bond  Straps  and  Lightning  Diverters  in  Nose  Radome 

• Install  Bond  Straps  on  Control  Surfaces 

• Install  Lightning  Arrestors  on  Electrical  Power  Buses 

• Install  Wiring  per  DFCS  Guidelines 

• Harden  Marginal  Equipment  Circuits 

• Bypass  Capacitors 

• Metal  Oxide  Bypass  Varistoi  s 

• Transient  Zeners 

• Series  Resistor  - Capacitor  Combination 

• Conduct  Lightning  Susceptibility  (Transient  Analysis)  Tests 


Figure  103 

Lightning  Protection  Plan 
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4.13  ELECTROMAGNETIC  COMPATIBILITY  (EMC) 


EMC  techniques  are  presented  in  Section  2.10.  A summary  of  the  EMC  considera- 
tions which  are  planned  for  implementation  in  the  ADP  are  presented  in  Figure  104. 


• EMC-  Bonding  Techniques  • 

• Ml  L B -5087 B 

*<  MCAIR  Process  Specifications 

• 

• EMI  Generation  end  Susceptibility  Control 

• MIL-STD461  Notice  3 • 

• MIL-STD462  Notice  2 

• EMC  Grounding  Provisions 

• Single  Point  Ground  Concept 


EMC  Wire  Processing  Techniques 

• Twisting  • Separation 

• Shielding  • Routing 

Subsystem  Interface  Control 

• Input  and  Output  Characteristics 

Control  of  Degrading  Effects  of  Aircraft  Environment 

• Airframe  Bonding  to  Provide  Equipotential  Ground  Plane 

EMC  Verification 

• Equipment  EMC  Tests 

• Aircraft  EMC  Ground  Tests 


Figure  104 

Electromagnetic  Compatibility  (EMC)  Summary 


4.14  WEIGHT.  SIZE.  AND  POWER 

The  estimated  weight,  size,  and  power  of  the  principal  components  of  the 
recommended  Digital  FCS  is  presented  in  Table  44.  The  general  arrangement  of  the 
recommended  ADP  configuration  is  shown  by  Figure  105. 


Table  44 

Estimated  Weight,  Size,  and  Power  of  Digital  FCS 


Principal  Component 

Weight 

(lb) 

Volume 
(cu  in.) 

Power 

(Watts) 

Mechanisms 

202 

NE 

NA 

Wire 

160 

NE 

NE 

Actuators 

451 

NE 

167 

Hydraulics  and  Supports 

259 

NE 

NA 

Battery  Installation 

109 

NE 

NE 

Electronics  Except  DIF 

135 

2,540 

480 

Digital  Interface  Unit 

93 

4,220 

450 

Panels 

4 

90 

1 

Controllers 

79 

2,100 

253 

Total  ♦ 

1,492 

8,950 

1,350 

Displays 

119 

3,618 

900 

Display  Electronics 

126 

4,530 

873 

Total 

1,737 

17,098 

3,123 

* = Excluding  Display  and  Their  Associated  Electronics 
NA  = Not  Applicable 
NE  = Not  Estimated 
I = Included  Elsewhere 
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Figure  105 

General  Arrangement 

Digital  Flight  Control  System  with  Advanced  Displays 
Recommended  ADP  Configuration 


4.15  SPARES.  GROUND  SUPPORT  AND  TEST  EQUIPMENT 

The  concept  for  support  of  the  Digital  FCS  recommended  for  the  ADP  is  the  same 
as  the  support  concept  used  during  the  SFCS  Program.  The  recommended  support  con- 
cept is  summarized  below. 

4 15  1 F-4  COMMON  (UNMODIFIED)  EQUIPMENT  - Unmodified  F-4  equipment  items  will  be 

requisitioned  as  needed  to  support  the  test  aircraft.  MCAIR  has  extensive  recor  s 
and  experience  with  F-4  S/N  62-12200  and  other  F-4  aircraft  used  for  testing 
purposes  and  can  prepare  estimates  of  required  spares  for  use  in  establishing 
minimum  necessary  stock  of  standard  F-4  items. 

4 15.2  F-4  MODIFIED  EQUIPMENT  - It  is  planned  that  certain  F-4  equipment  will  be 

modified  for  use  in  the  ADP.  1 For  example  the  F-4  Stabilator  Act. uator  has 
modified  to  provide  rod-end  load  instrumentation  and  structural  straps.  To  reduc 
delays  due  to  failures  of  this  type  of  equipment,  it  is  recommended  that  one  spar 
of  each  modified  F-4  equipment  item  be  obtained  and  stored  as  a spare. 

4151  DIGITAL  FCS  EQUIPMENT  - It  is  planned  that  four  flyable  sets  of  all  ^ 
Digital  FCS  equipment  be  procured.  This  will  provide  one  set  for  the  aircraft,  one 
set  for  the  Iron  Bird,  one  set  for  Flight  Worthiness  Tests  and  one  spare  set.  It 
is  not  anticipated  that  any  "bit  and  piece"  spare  parts  will  be  procured  and  stored 
at  the  test  site.  Repair  at  the  test  site  will  be  limited  to  LRU  replacement  an 
the  failed  LRUs  will  be  returned  to  the  supplier  for  repair  as  neede  . 

4.15.4  GROUND  SUPPORT  EQUIPMENT  - A Mobile  Ground  Test  Facility  (MGTF) , J4-foot 
highway  trailer7was  used  to  support  the  SFCS.  It  is  planned  that  the  MGTF  will 
be  modified  by  addition  of  special  support  equipment  so  that  it  can  be  use  o 

support  the  Digital  FCS  in  the  same  manner  that  it  was  used  to  support  the 

It  is  not  possible  to  prepare  detail  support  equipment  descriptions  until  the 
airborne  equipment  hardware  detail  design  has  proceeded  to  the  point  of  a design 
freeze",  however,  a list  of  ground  support  equipment  which  is  recommended 
ADP  has  been  prepared  to  aid  in  program  planning  and  estimating. 
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5*°  PROCUREMENT  AND  SUBCONTRACTING 


5 . 1 GENERAL 


c ■ i Subcontracts  were  placed  with  General  Electric,  Collins,  Honeywell  and  Lear 
llll  " t0  SUpp0rt  MCAI,!  ln  the  Analyses  and  Simulations  associated  with  this 

pLugr am ■ 

(22)  T!nHS?JurieS  °f  the  W°rk  accomPlished»  as  reported  in  References  (12),  (15) 
(22),  and  (23)  are  presented  on  the  following  pages. 


References : 


12.  Digital  Flight  Control  System  Study  Final  Report,  ACS  10,713 
General  Electric  Co.,  Binghamton,  N.Y.  October  1974. 

15.  Digital  FCS  Study  Final  Report,  523-0766085-00111M,  Collins 
Avionics  Division,  Rockwell  International,  Cedar  Rapids,  Iowa. 

15  February  1975. 

22.  Advanced  Fighter  Digital  Flight  Control  System  (DFCS)  Definition 

vtUdu  70!inal  ReP°rt  W0728-FR,  Honeywell,  Minneapolis,  Minnesota. 
March  1975. 


23. 


Advanced  Fighter  Digital  Flight  Control  System  Study  - Final 
Report  (Draft)  ADR-789,  Lear  Siegler,  Inc.,  Astronics  Division. 
Santa  Monica,  California.  April  1975. 
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5 . 2 SUMMARY  OF  REFERENCE  (12)  - TAKEN  FROM  G.E.  REPORT 


SUMMARY 


The  work  described  in  this  report  was  conducted  in  accordance  with  Purchase  Order 
Z40018  of  the  McDonnell  Douglas  Corporation,  St.  Louis,  Missouri  (MCAIR) . The 
project  title  is  Digital  Flight  Control  System  Study.  The  study  started  April  1,  1974. 
The  final  report  draft  was  submitted  September  3,  1974,  giving  a study  period  of 
22  weeks.  The  program  concerns  the  application  of  digital  flight  control  computers 
to  fly-by-wire  task  and  multimode  flight  control  computations. 

The  MCAIR  work  statement  lists  six  major  tasks  each  of  which  is  summarized. 

MULTIMODE  CONTROL  DEVELOPMENT 


The  multimode  control  law  development  followed  from  work  done  for  USAF  Flight 
Dynamics  Laboratory  under  two  previous  contracts.  Control  laws  were  synthesized 
for  several  control  tasks:  Air  combat  maneuvering  (ACM),  aerial  gunnery,  air  to 

ground  gunnery,  and  bombing.  Included  in  the  control  law  structure  were  angle— of - 
attack  (a)  and  side  slip  (8)  estimators.  These  provided  a, 8 and  8 signals  for  the 
control  laws.  As  a result  the  control  law  structure  has  the  inherent  ability  to 
provide  enhanced  vehicle  coordination  and  stable  responsive  control  of  high  angle 
of  attack.  The  ACM  mode  was  programmed  on  the  MCAIR  simulation  and  integrated  with 
the  MCAIR  developed  control  laws . 

The  angle  of  attack  and  side  slip  estimator  ar.d  the  air  combat  maneuver  modes 
were  further  evaluated  by  programming  these  control  laws  on  the  General  Electric 
MCP-703  triplex  digital  flight  control  computer  and  conducting  a closed  loop 
simulation.  This  was  done  in  conjunction  with  the  digital  implementation  of 
control  laws  task. 

DIGITAL  IMPLEMENTATION  OF  CONTROL  LAWS 

To  study  the  digital  implementation  of  control  laws,  including  stability  and 
dynamic  performances  of  an  airborne  digital  computer,  a simulation  program  was 
written  using  the  Xerox  SIGMA  5 scientific  computer.  The  computer  simulation 
includes  digital  to  analog  (D/A)  converters,  analog  to  digital  (A/D)  converters 
and  an  analog  simulation  of  the  aircraft.  This  simulation  was  used  to  develop  the 
filter  mechanizations  and  other  transfer  functions  used  in  flight  control  systems 
and  to  evaluate  these  in  open  and  closed  loop  tests.  Closed  loop  tests  were 
conducted  at  25,  50  and  100  iterations  per  second. 

Closed  loop  operation  was  then  undertaken  with  the  General  Electric  MCP-703  triple 
digital  flight  control  computer  to  verify  simulated  operation.  Structural  filter 
mechanizations  were  evaluated  at  163  iterations  per  second  with  a filter  notch  of 
141  radians  per  second.  Closed  loop  operation  with  the  MCP-703  triplex  digital 
flight  control  computer  demonstrated  satisfactory  performance  of  the  structural 
filter  mechanization  and  the  air  combat  maneuver  control  laws  developed  in  the 
multimode  control  development. 
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Fixed  point  mechanization  of  digital  filters  was  directly  addressed  and  resulted 
in  development  of  three  algorithms  which  cover  the  spectrum  of  filter  precision 
requirements.  Each  is  increasingly  more  complex  but  also  more  precise  and  it  is 
not  anticipated  that  flight  control  requirements  will  exceed  the  most  precise 
algorithm.  The  structural  filter  was  primarily  used  to  evaluate  the  algorithms 
in  closed  loop,  real  time  test  using  the  MCP-703  system  and  verified  predicted 
performance. 

DATA  REASONABLENESS 

The  data  reasonableness  task  studied  the  application  of  the  a and  3 estimators  to 
the  error  testing  of  sensor  inputs  such  as  angle-of-attack,  side  slip  and  aircraft 
pitch,  roll  and  yaw  rates.  The  work  included  an  error  analysis  of  the  angle-of- 
attack  estimator.  Data  reasonableness  tests  of  this  sort  offer  significant  advant- 
ages, by  introducing  signals  from  all  redundant  sensors  to  each  estimator  (via  cross 
channel  digital  data  transfer)  the  estimators  have  the  capability  to  derive  improved 
signal  estimates.  Data  monitoring  points  are  the  estimator  error  feedbacks.  An 
excessive  error  at  that  point  triggers  the  removal  of  that  error  signal  from  the 
estimator  computation  while  allowing  further  error  monitoring  to  determine  if  the 
error  represents  a fault.  In  summary,  this  technique  while  still  in  its  infancy 
offers  an  inherently  simple  and  elegant  technique  for  sensor  fault  monitoring,  which 
may  provide  significant  reductions  in  redundant  system  software  and  hardware 
devoted  to  the  sensor  monitoring  and  fault  detection  task. 

IN-LINE  MONITORING  OF  SENSORS  AND  ACTUATORS 

The  in-line  monitoring  of  sensors  and  actuators  task  was  conducted  in  three  phases. 
First,  the  methods  of  in-line  monitoring  currently  used  or  studied  in  past  contracts 
were  summarized.  Secondly,  other  methods  which  are  particularly  suited  to  the 
digital  flight  control  configuration  under  study  were  documented.  The  third  part 
consisted  of  breadboard  circuit  design  and  evaluation  of  those  methods  which  are 
particularly  suited  to  the  systems  under  study  and  for  which  test  data  was  not 
available.  The  in-line  monitoring  applicable  to  the  digital  flight  control  are 
the  following: 

In-line  monitor  of  LVDT's 

In-line  monitor  of  servoed  accelerometer 

In-Line  monitor  of  rate  gyro 

Actuator  monitoring 

Design  data  on  the  LVDT  monitor  from  the  heavy  lift  helicopter  direct  electrical 
link  program  was  included  in  the  study.  The  in-line  monitors  for  servoed  accelero- 
meters and  rate  gyros  were  designed,  breadboarded  and  evaluated  with  their  respective 
sensors.  Applying  in-line  monitoring  to  the  force  summed  secondary  actuator 
required  some  cross  channel  data  transfer.  The  failure  detect  logic  for  a triplex 
dual-fail-operational  servoactuator  is  described. 


COMPUTER  RF.T.T  ABILITY  (MTBF)  . REDUNDANCY  AND  SELF- TEST 


systenTcOTfiguiation^studies^an^evaluation^of 'Bystem^es^techniques^^ffliree  prime 

system  configurations  were  studied. 


Quadruplex  Flight  Control  System  with  Dual  Multimode  Sensors 


Quadruplex  Flight  Control  Sensors  and  Secondary  Actuators, 
Triplex  Computers  and  Dual  Multimode  Sensors 


Triplex  Flight  Control  System  with  Dual  Multimode  Sensors 


was  defined  which  expressed  computer  fault  estimating  this  confidence 

a failure  rate  proportion.  ^f^tCtlcal  sampling  techniques  appears  to  be  the 
Xpp”cticaeSd  ,«  asUssU  the  self-monitoring  performance  of  complex 
digital  systems. 


REPORTS  AND  OTHER  DATA 
Monthly  status  reports  were  issued  and  a final  report  was  prepared. 


In  summary,  the  work  conducted  will  pro,.  “^^t^e'cLltrol 

digital  flight  control  system  configuration  for  fly  by-wire  ana 

requirements . 


5 . 3 SUMMARY  OF  REFERENCE  (15)  AND  SIMULATION  EFFORT  BY  COLLINS 


Collins  role  in  the  DFCS  study  program  provided  a system  concept  and  feasibility 
analysis  for  a Digital  Flight  Management  System,  these  concepts  were  implemented 
and  evaluated  in  the  DFCS  simulation. 

The  report  addresses  the  philosophy  for,  the  operation  of,  the  benefits  derived 
and  problem  areas  of  implementing  a Digital  Flight  Management  System  in  a modern  or 
future  fighter  aircraft.  The  DFMS  is  essentially  a "front-end"  organizing  system 
for  a number  of  other  major  avionics  systems.  Included  as  candidate  functions  for 
integration  and  time-sharing  of  controller,  display,  anu  processor  elements  are: 
fully  automatic  navigation  sensor  management,  sensor  monitoring,  unified  horizontal 
situation  display,  electronic  chart  and  threat  display,  automatic  flight  plan 
management  and  3D  steering  outputs,  mission  and  navigation  data  base  management, 
fuel  management  aids,  multi-function  displays  mode  control,  and  some  checklists 
and  emergency  procedures  functions. 

Those  functions  included  as  candidates  for  time-sharing  display  and/or  controller 
elements  but  NOT  processor  elements  are:  multi-mode  flight  control,  energy 

management,  communications  (digital  and  voice),  IFF,  AAI,  multimode  radar,  electronic 
warfare  and  threat  evaluation  displays,  and  electro-optical  sensors. 

The  DFMS  complements  the  Multimode  Flight  Control  System  to  give  capabilities 
never  before  present  in  fighter  avionics  systems  while  at  the  same  time  reducing 
pilot  workload,  error  probabilities,  and  required  instrument  panel  areas. 

Particular  subject  areas  included  are  pilot-computer  communications,  multi-sensor 
navigation,  pilot  workload  analysis,  software  management,  reliability  analysis, 
candidate  system  architecture,  and  basic  LRU  definition  with  recommendations  for 
a flight  test  evaluation. 

Technology  levels  considered  for  basic  LRU  definition  were  those  expected  to  be 
available  in  the  1976-1978  time  frame.  All  other  conceptual  information  remains 
valid  for  technologies  expected  in  the  1980' s. 

Collins  role  in  the  DFCS  simulation  was  to  provide  equipment,  software,  pilot  train- 
ing aids,  and  appropriate  interfaces  with  MCAIR  simulator  and  computers  in  support 
of  a real-time  dynamic  simulation.  The  equipment  provided  included  a Collins 
8564B-2A  computer,  a modified  813H-1B  computer  and  displays  controller  unit 
(CDC-1) , a modified  ACD-70  electronic  chart  system  (for  MFD-2  functions),  and  a 
flight  data  storage  unit  (8848D-2)  for  mass  storage  of  basic  computer  programs, 
flight  plans,  navigation  and  steering  programs,  cartographic  data,  and  control  and 
display  programs. 

The  major  functions  provided  by  Collins  in  the  simulation  included: 

a.  Digital  flight  control  mode  selection 

b.  Simulated  automatic  position  fixing 

c.  3D  flight  plan  management  and  steering  outputs 

d.  Moving  map  display  and  HSI 

e.  Emergency  procedure  display 

The  pilot  interface  to  this  equipment  and  functional  description  is  presented 
in  the  pilot  training  materials  included  in  the  study  report. 
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In  summarizing  this  study  report  the  following  conclusions  and  recommendations 

are  offered: 

Conclusions . 

a.  A digital  flight  management  system  of  the  type  described  could  be  implemented 
with  currently  available,  near  state-of-the-art  devices. 

b.  Pilot  workload  and  procedural  errors  would  be  reduced  considerably  through 
the  multisensor  automatic  navigation,  subsystem  management  and  control,  and 
flight  plan  management  concepts  presented. 

c.  The  use  of  this  system  would  reduce  considerably  the  panel  area  required 
and  at  the  same  time  provide  a considerable  increase  in  the  functional 
capability  in  the  flight  control,  navigation,  display,  and  subsystem  management 
areas. 

d.  A dual  system  implemented  as  described  provides  mission  completion  information 
after  one  failure  and  aircraft  survivability  data  after  two  failures.  A rather 
unique  capability  of  this  concept  is  that  in  a single  system  failure  condition, 
the  pilot  system  interface  rules  remain  constant,  which  is  superior  to  the  cur- 
rent method  of  having  a different  set  of  procedures  for  failure  conditions. 

Recommendations : 

a.  The  systems  to  be  managed  by  and  their  interface  with  the  digital  flight 
management  system  should  be  defined  as  soon  as  possible  for  the  flight  test 
program.  This  is  a necessity  as  it  must  precede  initial  computer  (speed, 
memory  size)  and  external  memory  sizing. 

b.  A dual  system  installation  as  herein  described  must  be  seriously  considered 
for  the  flight  test  program.  There  are  significant  questions  in  the  areas  of 
management  functions  assigned  to  dual  systems  and  reversionary  capabilities 
that  can  be  answered  only  by  flight  test.  Thus,  the  coordination  of  (partially) 
dual  systems  must  be  regarded  as  a major  subject  of  concept  validation  program. 

c.  A reasonably  accurate  definition  of  all  A/C  subsystems  to  be  managed  by  the 
digital  flight  management  system  will  have  to  be  made  prior  to  the  sizing  of 
the  computer  and  mass  memory.  The  detail  definition  of  CDC  logic  and  display 
formats  and  major  elements  of  MFD  content  can  occur  concurrently  with  the 
system  development. 
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5.4  SUMMARY  OF  REFERENCE  (22)  --  REPRINTED  FROM  HONEYWELL  REPORT 


INTRODUCTION  AND  SUMMARY 


Ti!-V’ep0rt  con^a^ns  the  results  of  investigations  conducted  in  several  technology  areas 
which  are  important  to  a digital  fly-by-wire  flight  control  system  development.  This  work 
was  done  in  support  of  a McDonnell  Douglas  Corporation  (MCAIR)  study  program  -- 
Advanced  Fighter  Digital  Flight  Control  System,  Definition  Study  (Digital  FCS  Study)." 
the  report  is  organized  into  seven  sections,  plus  supporting  appendices.  The  sections 
are  briefly  summarized  below. 

• Section  1 - Redundancy  and  Reliability  Concept  Investigation  --  A tradeoff 
study  of  six  candidate  redundancy  configurations  applicable  to  a digital 
flight  control  system  (DFCS)  is  presented.  The  configurations  were  sup- 
plied by  MCAIR.  In  addition,  a detailed  investigation  is  made  of  numerous 
technical  issues  associated  with  the  derivation  of  a redundancy  management 
scheme.  Based  on  the  tradeoff  study  and  the  detailed  redundancy  evalua- 
tions, a baseline  configuration  is  defined  and  recommended  for  the  DFCS. 

This  configuration  is  a simple,  triplex  digital  system  with  a computer-to- 
computer  data  exchange  transmission  as  the  only  link  between  redundant 
channels.  Finally,  the  feasibility  of  a dissimilar  backup  channel  is 
examined,  with  emphasis  being  placed  on  fluidic  technology  as  a potential 
approach  to  add  reliability  and  provide  lightning  and  radiation  immunity. 

• Section  2 - Data  Reasonableness  Concept  Investigation  --  Several  approaches 
to  single-channel  fault  detection/ isolation  using  data  reasonableness  testing 
are  discussed.  This  type  of  testing  is  applied  as  an  alternate  to  adding 
redundant  sensors  for  fault  detection.  The  general  conclusion  reached  is 
that  this  type  of  testing  will  be  applied  only  for  specific,  unique  require- 
ments. 

• Section  3 - In-Line  Monitoring  Concept  Investigation  --  In-line  monitoring 
techniques  applicable  to  a redundant  DFCS  are  described.  These  techniques 
are  especially  important  to  a triplex  DFCS,  such  as  the  baseline  configura- 
tion, in  that  they  provide  much  of  the  self-test  capability  required  to  achieve 
acceptable  flight  reliability  levels.  All  of  the  in-line  monitoring  concepts 
discussed  would  be  used  in  such  a DFCS  mechanization. 

• Section  4 - Energy  Management  Development  and  Implementation  --  An 
energy  management  autopilot  control  loop  is  developed  and  analyzed. 

Performance  results  are  presented  for  the  F4E  aircraft  with  candards. 

Acceptable  intercept  and  path  following  performance  is  obtained  with  the 
developed  control  laws. 

The  computer  requirements  for  on-line  generation  of  energy  management 
profiles  are  also  estimated.  The  computer  load  is  sufficient  that  integra- 
tion with  the  DFCS  computer  is  not  feasible. 

• Section  5 - Digital  Implementation  of  Control  Laws  --  With  Honeywell's 
HDC-301A  processor  selected  as  the  nominal  DFCS  computer,  sizing 
estimates  are  made  for  the  DFCS  control  laws  provided  by  MCAIR.  In 
addition,  using  Honeywell's  DIGIKON  software,  the  control  laws  are 
analyzed  for  iteration  rate,  word  length,  and  digitization  effects  on  per- 
formance. This  analysis  provides  the  basis  for  the  computer  parameter 
selections  that  are  made  and  recommended. 

A technical  discussion  of  control  law  digitization  design  considerations  and 
an  approach  to  modularizing  the  control  software  are  also  included  in  this 
section. 
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* Section  G - Pilot/ Computer  Communications  --  The  hardware  requirements 
for  several  different  displays  configurations  are  defined.  The  information 
that  is  to  be  presented  by  this  hardware  on  a head-up  display  (HUD)  and  two 
multifunction  displays  (MFDs)  was  provided  by  MCAIR.  The  configurations 
include  use  of  redundant  display  drives  and  use  of  different  data  trans- 
mission interfaces  with  the  DFCS  mechanization. 

Software  sizing  estimates  required  for  the  display  information  are  also 
made. 

• Section  7 - Software  Development  --  The  various  aspects  of  developing  and 
using  safe  flight  software  are  discussed  in  detail  in  this  section.  Included 
are  techniques  for  verifying  the  flight  software.,  support  hardware  and  soft- 
ware, software  configuration  and  change  control,  and  an  estimate  of  a 
realistic  development  schedule. 

It  is  concluded  that  the  verification  and  control  requirements  must  begin 
with  a proper  software  structure,  which  uses  modular  techniques,  followed 
by  a rigorous  set  of  test  procedures  to  debug  the  software.  Change  control 
is  exercised  on  the  computer  product  end  item  (i.e.,  airborne  computer 
tape  and/or  software  listing)  in  much  the  same  manner  as  control  over 
hardware  has  been  accomplished  in  the  past. 


DFCS  SOFTWARE  SIZING  SUMMARY 

An  overall  software  sizing  estimate  of  the  DFCS  system,  excluding  displays,  is  shown 
in  Table  0-1.  These  summary  data  are  based  on  the  control  function  software  sizing 
done  in  Section  5,  the  redundancy  management  estimates  of  Section  1,  the  in-line  moni- 
toring requirements  of  Section  3,  and  projections  of  executive  functions  (e.g.  , mode 
logic  and  initialization)  from  the  experience  gained  on  the  A7  Digital  Multimode  and  JA37 
DFCS  programs.  Based  on  the  baseline  configuration,  requirements  for  the  DFCS  are 
159,200  operations  per  second  of  computational  time  and  8217  words  of  memory.  This 
is  well  within  the  capability  of  the  selected  Honeywell  HDC-301A  computer,  which  has  a 
speed  capacity  of  217,000  operations  per  second  computational  time  using  the  instruction 
mix  identified  in  Section  5.  It  can  also  interface  with  16,000  words  of  memory,  which  is 
the  software  complement  assumed  for  the  redundancy  tradeoffs  of  Section  1. 


Table  0-1.  DFCS  Sizing  Estimate  - Baseline  Configuration 


Parameter 

Computation  Time 

Memory 

Mul/ Sec 

Add-Load/Sec 

I/O/ Sec 

Total 

Instructions 

Data 

Control  laws 

9900 

03, 000 

4520 

77, 480 

3259 

1410 

Sensor  processing 

... 

12,000 

1980 

14,  580 

400 
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In-line  monitoring 

900 

33, 080 

3200 

37,240 

485 

95 

Actuator  monitoring 

... 

12.  100 

1280 

13,340 

222 

48 

Mode  logic 

... 

9000 

1200 

10,  800 

530 

54 

Noncritical  S.P. 

... 

4800 

POO 

5700 

102 

72 

Initialization 

... 

... 

... 

... 

100 

10 

P re  flight  BIT 

... 

.... 

... 

... 

1200 

40 

Total 

10,920 

135,240 

13, 140 

159,200 

6304 

1913 

Percent  of  Total 

0.  85 

84.  9 

8.25 

100 

... 

... 
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STUDY  SUMMARY 

Flight  control  requirements  have  become  increasingly  complex  in  modem  air- 
craft with  ever  increasing  growth  in  the  computational  requirements  for  which  more 
components  are  needed.  This  in  turn  causes  an  increase  in  the  size  and  a corresponding 
decrease  in  the  reliability  of  conventional  analog  flight  control  computers. 

In  order  to  overcome  this  problem,  the  use  of  digital  computation  has  been 
explored  by  both  industry  and  government  laboratories.  As  a result,  the  feasibility  of 
utilizing  digital  computation  for  automatic  (light  control  has  been  established  through 
several  hardware  developments  and  experimental  flight  test  programs.  As  a result  of 
many  analytical  and  hardware  studies,  Astronics  developed  a digital  computer  specifi- 
cally for  flight  control.  The  result  of  this  effort  is  the  ASTRO-1601  central  processing 
unit  and  associated  input/output  and  control  and  display  units  all  of  which  have  been 
built  and  tested. 

The  advanced  fighter  digital  flight  control  system  study  reported  here  was  based 
upon  the  previous  and  current  experience  and  consisted  of  evaluation  of  the  configura- 
tion concepts  applicable  to  the  advanced  fighter  flight  control  problem  and  demonstra- 
ting these  concepts  with  hardware  in  the  laboratory.  The  study  was  organized  around 
four  major  areas,  namely,  establishment  of  a digital  flight  control  system  redundancy 
management  concept,  examination  of  synchronous  versus  asynchronous  computer 
operation,  development  of  digital  computer  self  test,  routines  and  a redundant  hardware 
laboratory  demonstration. 

The  redundancy  management  concept  was  developed  around  the  selection  of  a 
system  configuration  from  various  alternates.  A system  configuration  baseline  was 
established  consisting  of  a variety  of  input  redundancy  levels  to  satisfy  the  various  fail 
operative  requirements.  For  example  the  sensors  involved  in  the  two  fail-op  modes  are 
defined  as  quadruplex  in  the  baseline  while  sensors  required  for  single  fail-op  are 
triplex.  In  order  to  maintain  the  integrity  of  the  quadruplex  sensors,  four  input  pro- 
cessors arc  utilized.  The  digital  computers  defined  for  the  study  are  based  upon  the 
ASTRO-1601  microprogrammed  processors.  With  the  use  of  high  confidence  in  line 
monitoring  capability,  the  computers  can  achieve  two  fail-op  capability  with  only  three 
units,  therefore  the  baseline  is  defined  with  triplex  computers.  The  actuators  are 
assumed  to  have  a high  in  line  monitoring  capability  and  therefore  are  defined  as  triplex. 

In  order  to  answer  several  issues  that  have  arisen  with  respect  to  the  use  of 
synchronous  or  asynchronous  operation,  a study  was  conducted  involving  the  simulation 
of  a triple  redundant  computer  configuration  on  an  IBM  370  general  purpose  computer 
facility.  The  purpose  of  the  simulation  was  to  examine  input  accuracy  and  bias  effects, 
independent  sampling/ computation  rates,  high  input  signal  rates,  and  integrator  divergence. 
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In  the  study  of  the  trade-offs  between  synchronous  and  asynchronous  operation,  those 
factors  which  would  appear  to  be  differences  between  the  two  operations  are  discussed. 
The  main  points  answered  are  the  benefits  which  are  offered  in  either  approach,  the 
mechanization  differences,  the  operational  differences  and  the  reliability  differences. 

This  study  verifies  that  asynchronous  operation  provides  more  reliability  when  employed 
in  redundant  digital  flight  control  systems  through  the  avoidance  of  the  potential  single 
point  failures  of  synchronized  clock  operation.  It  also  avoids  the  necessity  to  develop 
and  qualify  redundant  hardware  clocks  or  to  develop  and  validate  the  software  logic 
for  a software  clock.  This  will  result  in  lower  program  costs  for  the  asynchronous 
approach.  Another  benefit  of  asynchronous  operation  is  the  reduction  in  EMI  induced 
control  surface  transients.  This  results  from  the  fact  that  there  is  a low  probability  of 
all  channels  being  in  the  same  computation  cycle  at  the  time  the  EMI  eltect  is  present. 
The  subsequent  output  signal  selection  will  eliminate  the  single  channel  transient. 


Redundant  computer  operation  has  been  demonstrated  in  the  laboratory  using 
two  complete  channels  of  digital  computing  hardware.  In  addition,  the  redundancy 
management  concepts  of  input  signal  selection,  command  signal  selection,  integrator 
equalization  and  failure  detection  and  switching  have  been  demonstrated  as  well  as  the 
inherent  asynchronous  operation.  An  extensive  software  self  test  has  been  prepared  and 
partially  demonstrated  but  the  extent  to'which  it  can  detect  all  digital  computer  failures 
has  not  been  determined.  The  demonstration  program  utilizes  1360  words  of  memory 
and  the  timing  utilization  of  the  demonstration  program  is  32%  plus  self  test. 


Self-test  requirements  for  the  DFCS  computer  are  satisfied  by  providing  moni- 
toring and  test  features  for  each  function  of  the  computer.  The  power  supply  is  checked 
by  comparison  of  output  voltages  with  independent  references  and  current  level  monitors. 
The  CPU  is  checked  by  using  a watch  dog  monitor  and  a comprehensive  self-check  of 
the  microprogram  using  software  routines,  and  checking  for  illegal  combinations.  The 
servo  loop  is  checked  by  using  wrap- around  checks,  and  sample  inputs.  Since  most  of 
these  techniques  are  in  common  usage,  this  study  concentrated  on  the  area  that  is 
unique  to  the  Astronics  mechanization,  namely  the  self  test  aspects  of  the  ASTRO-1601 
and  in  particular  the  software  routines  which  can  provide  a high  level  of  self  test  capa- 
bility without  the  burden  of  additional  dedicated  self-test  hardware.  A software  self 
test  program  was  developed  which  performs  the  following  tests.  Every  instruction  is 
tested  at  least  once.  Every  instruction  addressing  mode  is  exercised  at  least  once. 

Every  possible  path  in  the  microcode  is  exercised.  Where  possible,  identity  relations 
are  employed  and  the  test  data  is  changed  at  each  iteration. 
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